Back from Hiatus (Part II): State Law Updates

Last week, I discussed three examples of Illinois courts analyzing similar non-compete issues in very different ways, a post that amply illustrates how difficult it is for lawyers to predict outcomes for clients. It also reminded me of a famous Abraham Lincoln quote: "Discourage litigation. Persuade your neighbors to compromise whenever you can. Point out to them how the nominal winner is often a real loser - in fees, expenses, and waste of time. As a peacemaker the lawyer has a superior opportunity of being a good man. There will still be business enough."

But to be sure, many people ignore Lincoln and litigate anyway - often with profoundly silly reasons motivating them.

So because we have litigation, we have legal developments and I therefore have a blog that continues to chug along. And you continue to read, meaning I must update you with some new rulings over the past several months.

California:

The infamous, long-running case involving ex-Korn/Ferry International executive David Nosal may have reached its end, with the Supreme Court declining a cert petition and the District Court now having finally decided on the scope of Nosal's restitution to KFI. United States v. Nosal is the most notable case under the Computer Fraud and Abuse Act, which generally criminalizes unauthorized access to protected computers. Nosal had its roots as a garden-variety trade secret case, but it was a criminal prosecution and tested the CFAA's limits.

Ultimately, Nosal secured some victories along the way. But still he will serve a year in prison and pay restitution to KFI. As to the scope of restitution, KFI sought about $1,000,000 in legal fees incurred to assist the Department of Justice investigation. After the Ninth Circuit weighed in KFI, will have to settle for less: $164,000. Still a heavy price to pay for Nosal, who probably deserved a civil suit but definitely does not deserve to spend a year in prison.

Connecticut:

The case of Datto, Inc. v. Falk discussed whether a forfeiture-for-competition clause was reasonable and enforceable. A minority of jurisdictions apply the same, or at least a similar, non-compete standard to these clauses, which (as one might expect) enable an employer to clawback certain benefits if an employee leaves to compete.

Forfeiture clauses range in scope, frequently calling for the forfeiture of unvested stock options but sometimes also calling for the employee to pay back income earned from the exercise of a grant within a certain period before the end of employment. Datto involved a dispute as to whether the cancellation of certain stock options were void because Falk (an ex-Chief Revenue Officer) accepted a position with a competitor.

The court was bound to apply Delaware law on the question of reasonableness, and that law in my view is somewhat confusing. Precedent, in effect, equated true non-competes with forfeiture clauses, finding they accomplished the same results. That's not necessarily true. A forfeiture clause may incent future performance, while a non-compete unquestionably tries to protect a separate economic interest beyond employee loyalty.

Datto illustrates the confusion in its analysis, though the district court judge admittedly was bound by controlling law. He noted, for instance, that the forfeiture clause was reasonable because "[t]his is not a case of an employee who is barred altogether from working for the competition anywhere in the world."

In my opinion, courts ought to use varying levels of scrutiny when examining restraints, similar to the current First Amendment jurisprudence. Specifically, I think that for employment-based non-competes, courts should use the strict scrutiny test (which by and large, they say they do), and for sale-of-business non-competes, they should examine them under a rational basis inquiry.

For mid-tier restrictions, like franchise non-competes and forfeiture clauses like that in Datto, I would use intermediate scrutiny. That test would require courts to determine whether the restrictive means used (e.g., the scope of the event triggering the forfeiture) are substantially related to the interest the restraint is designed to protect. This test, though it may not be perfect, would at least provide courts with a flexible, coherent way to analyze less problematic covenants that lack adhesive properties.

New York:

The New York Court of Appeals answered a significant question of damages related to trade secrets claims in the case of E.J. Brooks v. Cambridge Security Seals. The Court held that a plaintiff's damages cannot be measured by the costs the defendant avoided due to unlawful activity.

If a principal goal of trade secret law is to encourage innovation, then a cost-avoidance theory of damages seems to be a logical means to further that goal. Stated another way, if the misappropriation shortens a product-development cycle and enables X to bring a product to market more efficiently, then X is unjustly enriched by not incurring research-and-development expenses.

In the Court's view, cost-avoidance is inconsistent with a compensatory theory of damages. And under New York law, only the plaintiff's losses count. Cost-avoidance theory resembles unjust enrichment, but because New York has not adopted some variation of the Uniform Trade Secrets Act -- which specifically allows for unjust enrichment-type damages -- the theory is not viable.

The holding, predictably, spurred a long and persuasive dissent. It summarized the pragmatism and utility of cost-avoidance damages, noting that they are "generally much simpler than, and less subject to challenge than, lost-profit damages, which makes them an attractive alternative for plaintiffs who are willing to forego a potentially larger recovery in favor of a smaller, more certain one." (The assumption of a "smaller" recovery reasonably invokes the principle that a developer does not spend X to recover X. Normally, a rational economic actor would spend X to recover some multiple of X.)

A link to E.J. Brooks is available here. I emphasize again that I view this as a distinctly New York rule of law, and not one likely to be adopted across jurisdictions that have embraced a more flexible approach to damages.

South Carolina:

In Hartsock v. Goodyear Dunlop Tires North America, Ltd., the Supreme Court of South Carolina recognized an evidentiary privilege for trade secrets, but held the privilege was "qualified." That means it is different than, say, an attorney-client privilege or one barring self-incrimination. By "qualified," the Court held that a party seeking the disclosure of trade-secret material must show a "substantial need" for it that is relevant to the specific issues involved in the litigation. If a proponent makes that showing, the trade-secret holder still can gain the benefit of a protective order over the compelled disclosure.

The decision is, to be certain, a weird one. This is not really a privilege rule, but rather a rule of discovery that calls upon courts to make a balancing decision. If anything, this rule will create confusion where none should exist.

Texas:

Everything is bigger in Texas, including damages and attorneys' fee judgments. In the long-running case of Quantlab Technologies v. Godlevsky, a federal district court awarded the plaintiff its attorneys' fees in a trade secrets suit for what the court called defense behavior that was "so acrimonious, vexatious, and indefensible that...[it] exceeds any that this judge has seen in his nineteen years on the bench." The case involved stolen technology in the high-frequency trading industry, and the court at various times had sanctioned the defendants for destroying or failing to preserve evidence.

The price for that behavior was a fee judgment of $3,220,205 against each individual defendant.

The plaintiff didn't fare so well in GE Betz v. Moffitt-Johnston. There, the Fifth Circuit held that under Texas law, a company failed prove than ex-employee breached a customer non-solicitation covenant. The employee succeeded despite "highly suspicious" computer activity, including the mass download of data to an external device. But the company couldn't prove that any contacts with customers amounted to solicitation of business, rendering the contract claim unsupportable.

The Fifth Circuit did, however, vacate a large fee award for the ex-employee. Texas law allows an employee sued on a non-compete violation to obtain fees if the employer knows the agreement is overbroad and sues to enforce the agreement to an extent greater than necessary to protect the employer's interests. That's a hard standard to meet, absent some damaging admission or a truly terrible agreement. And the employee here didn't do so. 

The Reading List (2017, No. 26): Fee Awards, New Legislation, and Inevitable Disclosure

Non-Compete and Trade Secrets News for the week ended November 3, 2017

***

Illinois Appellate Court Affirms $1.5 Million Fee Award

In a Rule 23 Order, the Second District Appellate Court affirmed a substantial fee award, nearly $1.5 million, for the prevailing defendant in a fiduciary duty, trade secret, and non-compete case. I had the privilege of representing the defendant, Tom Christofilis, at trial and on appeal. It is truly a pleasure working with someone who is so candid, forthright, and credible that you don't even need to prepare him for his testimony. Good things happen to good people.

The basis of the $1.5 million fee award is rooted in corporate law and in particular the bylaw indemnification provisions that cover former employees, officers, and directors of Christofilis' former employer, Automated Industrial Machinery, Inc. I have written before that corporate indemnity procedures, whether rooted in internal documents like bylaws or through state statute, are the potential game-changer and equalizer in competition suits. It is essential that counsel fully assess the interplay of indemnity when deciding whether and how to pursue competition claims against a former insider. It is just as crucial for defense counsel to understand the legal framework and position his or her client for fee-shifting.

The Appellate Court's judgment here demonstrates the raw power of indemnification, ruling that it covered non-compete, trade secret, and fiduciary duty claims. But to be sure, this case was very fact-specific, and the availability of indemnification depended at least in part on Christofilis' complete success, the sheer breadth of the claims asserted against him, and the anchoring fiduciary-duty cause of action that brought the bylaw provisions into play.

Keep in mind the deferential standard of review applicable in this case. No two indemnification cases are the same. And the trial court retains substantial discretion in making the call as to what claims are and are not indemnifiable, given the pleadings, legal theories, and evidence.

A link to the Rule 23 Order in Automated Industrial Machinery, Inc. v. Christofilis is available here.

New Legislation on Non-Competes

For those interested in legislative updates, Russell Beck's Fair Competition Law blog is a must read. Here are a few links that discuss pending and enacted legislation on non-compete law:

October 21: Russell reports on bills in New York and Pennsylvania concerning very different aspects of non-compete reform.

October 15: Russell discusses bills in several states, including changes to Oregon and West Virginia law. Oregon now bans non-competes for home-care workers, while West Virginia outlaws certain types of physician non-competes. This continues a trend of industry-specific reform, rather than wholesale, across-the-board changes.

The DTSA and Inevitable Disclosure

The Defend Trade Secrets Act contains a crucial limitation on injunctive relief: courts cannot issue an injunction under the DTSA to "prevent a person from entering into an employment relationship." And conditions on a person's employment must be based on threatened misappropriation, not merely on information the person knows. This limitation forms part of the compromise that resulted in the DTSA's near-unanimous passage. And it departs from the law of several states that allow for inevitable-disclosure injunctions that bar employment altogether.

Courts, though, are frequently terrible at applying the doctrine of inevitable disclosure. A perfect illustration comes from the case of Express Scripts, Inc. v. Lavin, where a federal court appears to have applied the DTSA to issue an injunction, at least in substantial part on inevitable disclosure. It could be that the court was loose with its analysis, since it already had found a non-compete agreement to be enforceable. And it could be that the court was relying on Missouri law. But it sure as hell does not help to have a poorly engaged analysis like this, suggesting that the DTSA does not mean what it says.

I reviewed the briefs filed by the plaintiff's law firm (one that must remain nameless). The brief never indicates for the court that the DTSA limits inevitable-disclosure injunctions. It lumps stuff together in a way that I feel is highly misleading. That's troubling, because the court was ruling on a petition for temporary restraining order. More concerning is the court's rote copying of the law firm's brief (down to the word). This amounts to judicial abdication, not bona fide engagement.

Let's be clear: the DTSA does not permit inevitable disclosure injunctions of the kind that the court in Express Scripts may have ordered. This decision carries no weight at all. I'll chalk this one up to an emergency ruling, a busy judge, and sloppy lawyering.

A copy of the ruling can be found online (I refuse to link to it or make your job easy). The case name is Express Scripts, Inc. v. Lavin, No. 4:17-cv-1423 (E.D. Missouri). The case since has settled.

Computer Fraud and Abuse Act

The most significant CFAA case of the past several years has been United States v. Nosal, which made two trips to the Ninth Circuit. The Supreme Court has declined to grant certiorari on Nosal's latest appeal. That cert petition made headlines when Nosal enlisted Supreme Court star litigator Neal Katyal on brief. Reuters discusses the Court's decision not to review Nosal and a separate CFAA case called Facebook v. Power Ventures.

Speaking of the CFAA, it continues to generate fewer cases of interest in light of the Defend Trade Secrets Act and the federal civil remedy now available for trade secret misappropriation. But some cases still wind through the system.

The sharp divide, which stems in great part from Nosal, concerns the application of one statutory term in the CFAA: the meaning of the phrase "exceeds authorized access." In the CFAA framework, this could mean an individual's misuse of protected information in violation of a corporate policy or common-law duty. Or it could mean something far narrower, namely an employee's improper access of files in the more objective sense without regard to state of mind or intent.

In Hedgeye Risk Management, LLC v. Heldman, the United States District Court for the District of Columbia adopted the narrower reading of the CFAA. In effect, it held that the statutory language is not concerned with the purpose for which the employee accessed the computer files. In so doing, the court joins the Second, Fourth, and Ninth Circuits. On the other side of the ledger, the Fifth, Seventh, and Eleventh endorse a purpose-based analysis, with the reasoning of those courts varying to some extent. As the district court in Heldman noted, the D.C. Circuit has not weighed in.

***

Last week, I had the privilege of presenting at PLI in New York for a conference titled Trade Secrets 2017: What Every Lawyer Should Know. My panel consisted of Audra Dial from Kilpatrick Townsend & Stockton in Atlanta and John Siegal of Baker Hostetler. Our moderator was the great Vicki Cundiff of Paul Hastings. In the company of such luminaries, I felt like one of those fringe candidates on stage at a debate with the audience wondering who the hell I was. But my co-presenters were just terrific, and I thoroughly enjoyed it. For lawyers seeking to learn more about trade secrets, PLI offers a similar program via webcast next week.

Years back, I butted heads with Farmers Insurance in a number of non-competition cases, all of which settled pretty amicably. Apparently, Farmers has more problems to solve in this area, as reported by Insurance Journal. This suit sounds like it fits a familiar pattern in which an employee copied a number of documents and scooted off to a competitor. Of note, it's pending in California, which does have a trade-secret "exception" to its non-compete law.

Forbes has a long article about a burgeoning dispute between Citrix and Egnyte, one that brings to the fore the difficult procedural question that often arises when employees bolt for a California company but don't live in California.

Finally, if you're interested in further reading on an array of subjects, including the Waymo v. Uber case and Defend Trade Secrets Act case updates, I suggest linking to John Marsh's Trade Secret Litigator blog and his October monthly wrap-up. Lots of excellent source material here.

An Analysis of Two California Cases. Big California Cases.

Over the past week, we received two big decisions from two different California courts on two vastly different issues. One was a decision that has no precedential effect, but which garnered a lot of headlines, particularly in tech circles. That case was decided correctly. The other received almost no attention, but which is precedential. And that case was wrongly decided.

***

The Computer Fraud and Abuse Act and Data Scraping

I have a been a long-time critic of the CFAA, a law put together so haphazardly and over so many years that it is difficult to resolve important questions of statutory interpretation. The key legal question that arises under the CFAA - at least in the context of employee claims - is when one exceeds her authorized access to a protected computer or accesses that computer "without authorization." Put another way, many cases have analyzed claims of insider misappropriation within the CFAA's statutory text, even though it seems clear the statute didn't really have that type of case in mind.

But applying the "without authorization" language of the CFAA goes beyond just employment claims, as reflected in the important case of hiQ Labs, Inc. v. LinkedIn Corp. The case involved another question of statutory interpretation: whether the CFAA prohibited access to public LinkedIn profiles after LinkedIn revoked permission to such access.

A little background is essential, since the idea of an open internet is crucial to the case's disposition. hiQ Labs is a data analytics company. Its business model revolves around scraping data off of LinkedIn users' public profiles. It then can offer products to its client companies: an analysis of which employees are likely to leave or be recruited (such as by employees updating their skills and other LinkedIn fields) and a separate analysis of which skills individual workers possess.

LinkedIn demanded that hiQ stop scraping public data from its website, relying on its User Agreement and the term that prohibited data collection. hiQ sought injunctive relief, arguing that LinkedIn's threats undermined its business model and violated state statutory and common law. The analysis, though, hinged on the CFAA - for a reading of that statute in LinkedIn's favor would have preempted the offensive claims hiQ brought.

The district court found that the CFAA likely did not preclude hiQ's claims, and it relied on two general concepts. First, it distinguished other cases where CFAA infractions involved access to private, as opposed to public, data. And second, it looked to the law of trespass to conclude that, despite LinkedIn's supposed revocation of hiQ's access to public profiles on its website, hiQ hadn't circumvented any sort of authentication system to view those profiles. This analysis incorporated Professor Orin Kerr's influential Columbia Law Review article that discussed the law of trespass as explaining some of the ambiguity and context of the "without authorization" language in the CFAA.

The decision seems intuitive and obvious, but in large part it was constrained by the text of the CFAA itself, which has confounded courts over the years. Thank goodness we have thought leaders like Orin Kerr to make sense of the statute and provide the appropriate analytical framework on which courts can reconcile very difficult questions. Public websites need to be open and accessible, and operators cannot erect artificial barriers under the guise of an unread, boilerplate user agreement to invoke the specter of criminal liability for viewing and using what's freely available.

Malicious Prosecution

The second decision comes from the Supreme Court of California, where the Court absolved Latham & Watkins for its pursuit of a frivolous trade-secrets claim many years ago. That case made its way up to the Court of Appeal and is somewhat well-known to lawyers (like me) who believe that a robust, common-sense interpretation of "bad faith" is essential to defense fee-shifting claims. The case of FLIR Systems, Inc. v. Parrish, 174 Cal. App. 4th 1270 (2009), was the precursor to Parrish v. Latham & Watkins. In FLIR Systems, the Court of Appeal affirmed a fee award for the prevailing defendants after the plaintiff's trade-secret claim (and the expert testimony girding that claim) fell apart at trial. As the Court had held, the plaintiff's modest success in defeating summary judgment did not insulate the bad-faith fee award. That was a sound rationale: trade secrets plaintiffs often dodge, duck, and distract a trial court into believing there are factual issues in need of resolution.

Unfortunately, for the defendants in that case, the summary-judgment "loss" hurt them in a later, independent malicious prosecution claim that they brought against Latham & Watkins, the law firm that represented FLIR Systems. The Court of Appeal held that the so-called "interim adverse judgment" rule barred the malicious prosecution claim, a decision the Supreme Court of California affirmed last week.

That rule says that a malicious prosecution plaintiff cannot maintain a claim if a "trial court judgment or verdict" is rendered in favor of the plaintiff in the underlying suit - here the FLIR Systems litigation. The problem with applying this rule is that FLIR Systems' defeat of a summary judgment motion is not a judgment in and of itself. It's an interlocutory order that is not even appealable and is a reflection of the trial judge's perception that fact issues need a full airing in court. Indeed, a denial of a summary judgment motion is not a ruling on the merits in any sense.

California is ground-zero for crummy trade secrets claims, so the ruling is an important one. It is particularly important if the plaintiff cannot satisfy a fee award or if the pursuit of the claim caused collateral damage that flowed from the pursuit of the action (such as lost investors, delayed market entry, jettisoned goodwill). A fee award won't cover those damages, but a malicious prosecution suit will. The "interim adverse judgment" rule, applied to denials of summary judgment motions, is an artificial construct that insulates attorneys who pursue claims without an objective, good-faith basis. That they survive a summary judgment is by no means a reflection of the suit's merit, since the trial is where the facts are most tested. Courts need flexibility to assess whether the entirety of the prosecution was malicious, not whether the plaintiff's lawyers were skilled enough to defeat a motion.

An obvious consequence? California courts may see less summary judgment motions. Why risk it after the Latham & Watkins case?

The Reading List (2017, No. 21): Levandowski's Gone

Non-Compete and Trade Secrets News for the week ended June 2, 2017

***

Waymo v. Uber

We know what the lead story is: Waymo's suit against Uber. It seems every week produces new drama in the trade secrets case of the year. Why is it such a deal? We're talking about a technological development - self-driving cars - that may be among the most significant in the past hundred years.

Anthony Levandowski - the star engineer behind Waymo's self-driving car technology - has been fired from Uber. Presumably, his termination is a direct result of Judge Alsup's rulings and orders compelling Uber to account for the 14,000 files Levandowski apparently took before leaving Google. That spelled a clear division in where Uber and Levandowski were headed with this dispute.

For a thorough deconstruction of Levandowski's firing, I highly recommend reading John Marsh's excellent analysis. I couldn't do it better and won't try.

Trade Secrets Injunctions

One of the more vexing procedural questions in trade secrets cases is the extent to which wrongful conduct will be enjoined. To be sure, that was one of the flashpoints of Judge Alsup's ruling that effectively barred Levandowski from working for Uber in any competing capacity. But it didn't strictly limit what Uber could do to develop self-driving technology independent of Levandowski.

On a far more mundane level (all cases are more mundane) is Systems Spray-Cooled, Inc. v. FCH Tech, Inc., No. 16 CV 1085, out of the Western District of Arkansas. There, the court grappled with how much competitive activity to enjoin after two ex-employees had misappropriated certain design drawings and pricing information. The misappropriation finding came as a direct result of the defendants' destruction of hard-drive evidence. Without a governing non-compete, the court was faced with how far to extend a trade-secrets injunction. And here, given the evidence destruction, the court carved a middle ground - barring not only the "use" of certain information (assuming it was still available after the destruction) but also some business activity that arose from the misappropriation itself. The court would not go so far as to prohibit the defendants from working in a competitive industry, but did prevent them from using certain designs to develop competing products.

The price for a broader injunction? A $5 million bond.

David Nosal Heads to Washington?

So what's up with this guy? Besides Levandowski and Sergey Aleynikov, few names have become more household in the trade-secrets arena than David Nosal. The ex-Korn/Ferry executive was convicted under the Computer Fraud and Abuse Act for obtaining the password of a current employee. That allowed Nosal and others to access a database containing valuable information on executive search candidates. (For in-depth coverage, read Professor Orin Kerr's analysis here and a lengthier piece in the Harvard Law Review.)

After Nosal's petition for en banc rehearing was denied by the Ninth Circuit, he appealed his CFAA conviction to the Supreme Court. Representing him? Neal Katyal of Hogan Lovells, the former Solicitor General and premier appellate litigator. Nosal's petition for writ of certiorari was filed May 5.

How much does a typical non-compete case cost?

Aside from "is this thing enforceable?" the question I get asked most is "what's this gonna cost?"

What am I referring to? Non-competes and non-compete suits, of course. No easy answers there, because there are a lot of variables at play. Those variables range from the plaintiff's attorney (competent, middler, or bumptious fool) to the scope of the wrongful conduct alleged. Generally, if the case involves a claim of trade secrets misappropriation with what appears to be some kind of a physical taking of information, the litigation is hard to budget.

But what about a garden-variety non-compete case, about a customer here or there or perhaps even a dispute over the type of work the employee is engaging in? Hard to piece together data, but an unreported case out of Washington noted the prevailing employee spent about $53,000. We know that because the appellate court upheld the fee award. That amount seems about right for a case that does not proceed to trial but instead gets resolved on summary judgment.

The case is Gaddis Events, Inc. v. Wu, No. 75227-8-I, and it's available here.

The Reading List (2017, No. 14): Showing Irreparable Harm Requires Actual Facts

Non-Compete and Trade Secrets News for the week ended April 7, 2017

***

Franchise Non-Competes and Irreparable Harm

Disputes over franchise non-competes arise less frequently than employment-based covenants, but they tend to produce some interesting results. Often, they are combined with claims for trademark infringement if franchisees continue to promote their business using the same signage, slogans, or other source indicators that were part of the original franchise relationship. But other times, the franchisee simply ends the relationship and starts a completely separate business in the same territory.

A district court in Nebraska confronted precisely this type of fact-setting in Colorado Security Consultants, LLC v. Signal 88 Franchise Group and denied a preliminary injunction motion brought to enforce a 3-year non-compete. The interesting aspect of the decision, which is available here, concerns the discussion about "irreparable injury," a required element that a plaintiff must prove to establish injunction relief. The court was critical of the plaintiff's conclusory evidence about customer contact. And, at least according to the facts available in this opinion, it appeared the way in which the franchisor elected to end the relationship may have been a contributing factor in the court's denial of its injunction motion. The lesson here is intuitive. If you're asking for injunctive relief, then you need to demonstrate actual, concrete evidence that illustrates how continued competition threatens imminent injury. Abstract statements or mere suggestions of future harm won't cut it.

Bad Faith in Trade Secrets Actions

The bad-faith fee-shifting clause under the Uniform Trade Secrets Act allows for a "prevailing party" to recover fees. By definition, it does not apply to counsel. A successful showing of bad faith by a defendant entitles him to fees only from the plaintiff itself.

Last year, a California Court of Appeal decision in a case called Cypress Semiconductor found that a plaintiff's voluntary dismissal without prejudice did not prevent a defendant from claiming it had been a "prevailing party" for purposes of claiming fees under the bad-faith provision. This past week, the Illinois Appellate Court in an unpublished and non-precedential order disagreed with Cypress Semiconductor. It found that the term "prevailing party" could not include a voluntary dismissal without prejudice. The case is Matrix Basement Systems, Inc. v. Drake.

In the interest of full disclosure, I joined the representation of Tom Drake on appeal after the circuit court had denied his fee petition. Obtaining reversal of an order denying a motion for sanctions is quite difficult under an "abuse of discretion" standard of review, but I felt that Mr. Drake more than deserved a vigorous appeal. The appellate court's order, while not giving us the desired outcome, certainly helped establish that Mr. Drake was the victim of a completely meritless suit that never should have been filed in the first place. The circuit court found that Matrix Basement Systems had indeed lodged allegations against him that were false, but that this alone wasn't enough to warrant sanctions.

***

On his Michigan Employment Law Advisor, Jason Shinn has a more in-depth discussion with practical tips on Estes Forwarding Worldwide v. Cueller, the "Google Drive" access case I discussed two weeks back. The tips he offers are geared towards employers who need to secure web-based storage accounts from improper employee use.

Michael Elkon at Fisher & Phillips has an excellent compliance-oriented post dealing with the hiring of employees from competitors. This lengthy post covers a number of specific questions and procedures employers should be asking and investigating when hiring new employees from competitors.

Korn Ferry, the executive search leader which pursued the high-profile Computer Fraud and Abuse Act case against David Nosal, finds itself on the other end of a competition dispute. Spencer Stuart, a K/F competitor, filed suit in Chicago. This case appears to be more of a garden-variety non-compete dispute, but it involves the defection of a group practice leader - Francois Truc - who earned over $4 million a year from Spencer Stuart.

Munger Tolles & Olson released a 2016 Defend Trade Secrets Act Roundup summarizing DTSA filings and major issues that courts have decided under the law as we approach the one-year anniversary of its enactment.

Finally, Seyfarth Shaw this week flagged a pending bill in Missouri that would invalidate restrictive covenants in the employment setting. House Bill 479 would bring Missouri more in line with the California approach to restrictive covenants, which permits them in connection with the sale of a business. We see legislation creep up like this time and again in the States, but it usually is meant to spark debate that leads to incremental reform. Seyfarth's post on the Missouri bill is available here.

The Reading List (2017, No. 12): One Reason Florida Is So Non-Compete Friendly

Non-Compete and Trade Secrets News for the week ended March 24, 2017

***

Florida Non-Competes and Evidentiary Presumptions

The Florida District Court of Appeal's decision last week in Allied Universal Corp. v. Given illustrates why Florida is the safest haven for non-compete enforcement. It further shows how employers have benefited from a statutory directive that entitles them to a presumption of irreparable injury upon the showing of a legitimate business interest. That irreparable-injury showing is an indispensable component of injunctive relief. The case also shows the uphill burden an employee faces in trying to rebut evidence of a legitimate business interest, here the relationships that enable a salesperson to generate business. Employees who do so face a high discovery burden in amassing that type of evidence. Typically, they'll need something like high turnover or customer attrition or a narrative that shows how the new company provides a different customer value-proposition than the old one. A link to the Allied Universal case is available here.

(Eric Ostroff also discusses this decision in a blog post.)

The "Cloud" as a "Protected Computer" under the CFAA

The employment-related claims that a company may have under the Computer Fraud and Abuse Act all have a common requirement, which often is just assumed to exist in litigation: the access of a "protected computer." The way the CFAA is worded, any computer connected to the internet falls within the definition.

A fair number of cases now do not deal with claims where sensitive information was removed from a workplace computer. Instead, they concern disputes over information stored on a cloud-based platform that employees from computers access. So what happens when an employee continues to access this same platform, wrongfully, following termination of employment? Is this access of a cloud-based device equivalent to a "protected computer"? In Estes Forwarding Worldwide, LLC v. Cuellar, a federal judge in the Eastern District of Virginia said yes. But the analysis was very thin and not particularly persuasive.

Prior decisions, such as the Hawaii case of Property Rights Law Group v. Lynch, suffer the same flaw: no real attempt to reconcile a cloud-based service with the definition of a "protected computer." They seem to pivot to the fact that the computer was connected to the internet and end it right there. To the extent this issue becomes a genuine dispute among district courts, it seems Congress could head off the problem by extending the jurisdictional hook to accessing information stored on a cloud-based platform. After all, what's one more amendment to the CFAA?

The Estes Forwarding decision is available here.

The Reading List (2017, No. 10): South Carolina Interprets Stealth Confidentiality Agreement

Non-Compete and Trade Secrets News for the week ended March 10, 2017

***

South Carolina Non-Competes

The Court of Appeals of South Carolina issued a very interesting and important ruling on the oft-overlooked interplay between non-disclosure and non-competition covenants. The case is Fay v. Total Quality Logistics, LLC, No. 2014-1828.

In Fay, the Court of Appeals determined that an indefinite non-disclosure agreement operated as a stealth non-competition restriction, because it provided that if the ex-employee entered into a similar business as his employer and worked in a similar type of position, he would "necessarily and inevitably" use the employer's confidential information to perform his job. In other words, the agreement attempted to graft the devilish "inevitable disclosure" doctrine into a non-disclosure/non-competition covenant. Bad move. This contractual language in effect prohibited the employee ever from competing with his former employer. Under South Carolina's strict "blue-pencil" rule, the court couldn't modify the contract to add in a reasonable time limit. As such, it was unenforceable.

The concurring opinion offered the same conclusion, but first looked to Ohio law because that's what the parties agreed to apply to the contract. But even under Ohio law (which is more friendly), the indefinite non-disclosure agreement would be unenforceable. Fay represents yet another case in an emerging area: an employee's challenge of a broad non-disclosure agreement and arguing it operates as a stealth non-compete. You can read the opinion of the Court of Appeals by clicking here.

Proposed Amendments to CFAA

The Computer Fraud and Abuse Act has been amended many times since it first appeared on the scene in 1986. In reality, it needs to be rewritten or broken up into several different laws. But it's back on the legislative docket, at least if one Congressman has his way.

Rep. Tom Graves (R. GA) has proposed the Active Cyber Defense Certainty Act. The bill would allow victims of cyber-attacks to engage in limited defensive measures to identify and stop attackers. In essence, it's a bill that enables "hacking back" and formalizes that concept as a defense to prosecution for unlawful computer access. The text of the bill is available here.

The theory of hack-backs have generated a lot of debate among scholars in recent years, with some arguing that, even if legal, it could have dramatic unintended consequences in ensnaring innocent third-parties. It is often difficult to trace the source of a hack.

***

In other news, a great deal of news is floating around about Waymo, LLC v. Uber Techs., Inc., the trade secrets case involving Google's self-driving technology. News reports first surfaced a few weeks ago about the claim that featured, at its core, the departure of Waymo manager Anthony Levandowski and the supposed downloading of nearly 14,000 confidential Waymo files. Waymo appears to have suspected misappropriation based on the erroneous e-mail transmission of a circuit board drawing, intended for Uber but delivered instead to Waymo. A copy of the Complaint, which features a claim under the Defend Trade Secrets Act, is available here. The "Introduction" sets forth the big-picture story and is a great example of persuasive legal writing.

***

For those interested in the ex parte seizure order procedure available under the DTSA, this link contains the first ever federal court seizure order carried out. The case is Mission Capital Advisors LLC v. Romaka, No. 1:16-cv-5878 (S.D.N.Y.). The collateral costs of obtaining such an order are fairly high. Of note, the defendant in this case never was represented by counsel during the litigation.

***

Finally, the U.S. Attorney's Office in the Middle District of Louisiana released a statement on February 16 that confirms the sentence of Brian Johnson for violating Section (a)(5)(A) of the CFAA. Johnson's guilty plea stemmed from his installation of malicious code on Georgia-Pacific's information technology system after G-P terminated his employment. The code resulted in significant damage to G-P's operations. Johnson will serve a 3-year prison term and must pay more than $1 million in restitution.

The Reading List (2017, No. 2): Ex Parte Seizure Orders and Attorney Disqualification

Non-Compete and Trade Secret News for the week ended January 13, 2017

***

Defend Trade Secrets Act

We have the first district court opinion dealing with the relatively new (and highly controversial) ex parte seizure order available under the federal Defend Trade Secrets Act. In OOO Brunswick Rail Mgmt. v. Sultanov, a federal district court denied an application to have a court order the seizure of e-mail information maintained by third-party providers (such as Google), reasoning that the providers would be required to preserve it anyway. The court further denied the ex parte application to the extent it sought to seize the company-issued laptop and mobile phone in the defendant's possession, since the court ordered the defendant to produce them at the injunction hearing.

The order, a copy of which is available here, illustrates that the ex parte seizure order remedy may be more bark than bite, as courts already have at their disposal a number of less intrusive means to preserve data and the integrity of the litigation process. They no doubt will use them before deploying this very unique, and disfavored, remedy.

Hard-Drive Inspections

Writing a blog post on motions to compel is like describing your workout routine to someone else. You immediately sense eyes glazing over. However, at the risk of turning readers away, I'll mention one ruling that I recently read.

A recurring trade-secrets discovery issue seems to be one party's request that an adversary turn over hardware for forensic inspection. Because computers and external devices often are the means to pilfer protected information, it is logical for an aggrieved party to ask for a direct inspection of those devices. However, courts still are reluctant to do so and rely on the traditional discovery process to generate accurate responses, even when computers make the process more cumbersome and opaque. Courts normally won't order the direct production of devices unless there is proof they were used in the act of misappropriation or there is some history of discovery non-compliance. But even then, as Brand Services, LLC v. Irex Corp. illustrates, courts have the discretion to order the production of electronically stored information pursuant to a less intrusive key-word search protocol. Direct production of devices remains the exception rather than the rule.

Ethics

Non-compete disputes raise a lot of interesting conflicts and ethics question. But a very stark and sobering reminder comes from CytImmune Sciences, Inc. v. Paciotti, in which Judge Paul Grimm of the District Court of Maryland disqualified an employee's counsel because he previously worked on the same confidentiality agreement on the plaintiff's behalf many years prior.

Judge Grimm disqualified Alston & Bird since the lawyer's continued representation of the employee was materially limited due to his past representation of the employer. The material limitation apparently crystallized when defense counsel did not advance an argument on the agreement's enforceability (a facial challenge) during injunction briefing. That was particularly problematic for the court since it found the agreement unenforceable on its face and felt another attorney could have made a "full-throated facial challenge to the breadth of the" contract. The ruling is available here. (Not addressed, but perhaps looming, is the possibility the firm will need to disgorge fees from the engagement.)

***

From around the web, lots of material on the Defend Trade Secrets Act percolating...

Cozen O'Connor writes that trade secrets litigation will spike in 2017. In Judge Grimm's parlance, I'll lodge a "full-throated" disagreement. It may, but who knows? The post seems to suggest the ex parte seizure order process is the reason, but come on. No one sues based on the slim chance that a court may issue what amounts to a temporary discovery order. What seems likely is an uptick in federal litigation, as practitioners have a full year to assess the DTSA, and employees have a full year of ignoring both common sense and their lawyers' advice on how to leave their jobs.

The Legal Intelligencer has an overview of the DTSA, and it emphasizes remedies. Again, there's a fulsome discussion of the seizure order. Lots of noise about something unlikely to generate much real action.

In a similar vein, Christopher Stief of Fisher & Phillips published this piece on Law.com, also discussing questions looming as courts implement the DTSA.

Somewhat related to DTSA commentary is Perkins Coie's terrific post from January 5 entitled How Will Criminal Trade Secret Prosecutions Fare under President Trump? This article describes the federal criminal statutory framework for trade-secret theft, which was rarely used until the Obama Administration made it a priority. This is well worth a read, even for civil litigators.

***

Finally, there's an interesting DTSA case pending in New Jersey called Chubb INA Holdings v. Chang, No. 3:16-cv-02354. Pending before the District Court is a defense motion to dismiss a Computer Fraud and Abuse Act claim and a DTSA claim.

The CFAA motion is premised on a Nosal-style theory that the employee's access to protected computers was not in excess of authorized access, while the DTSA argument presents a more novel issue. It examines the DTSA's applicability to conduct that at least started before the DTSA went into effect. From briefing, it appears the question may hinge on whether the new federal statute would apply to either an inevitable disclosure theory of misappropriation or the continued retention of information after the DTSA's effective date (even if the predicate acts took place beforehand).

The motion to dismiss is available here. The response brief is here.

Does Nosal II Solve "Without Authorization" Question?

The trade-secrets community has awaited the follow-up decision to the long-running prosecution of former Korn/Ferry executive, David Nosal, based in part on the controversial Computer Fraud and Abuse Act. And with the Ninth Circuit's decision on July 5 in United States v. Nosal, the question remains whether we have answered any questions about the CFAA's potential reach.

Nosal I, a 2012 decision, was largely pro-employee and restricted the scope of the CFAA's most controversial provision - the so-called "exceeds authorized access" prong of Section 1030(a)(4). As a result of Nosal I, the consensus seems to be building that violations of use policies do not mean that a user exceeding his authorized access of a protected computer. In other words, it is not sufficient to base an (a)(4) claim on misuse.

But Nosal I did not address the other part of (a)(4). One cannot obtain anything of value out of a protected computer if he accesses a protected computer "without authorization." And that's where Nosal II squarely lands. The Ninth Circuit upheld Nosal's conviction on multiple CFAA claims under this aspect of (a)(4) under a fact paradigm that is well-known to trade-secret practitioners. Nosal and two ex-employees of Korn/Ferry obtained the password of a then-current Korn/Ferry employee to access a database containing valuable information on executive search candidates.

Was that access "without authorization" under (a)(4)? Yes, said a divided panel of the Ninth Circuit.

The case predictably has produced a lot of commentary, but the most essential read is Orin Kerr's lengthy analysis. The crux of the case hinged on whether it mattered that the current employee gave Nosal's co-conspirators the database password. The majority felt it crucial that Korn/Ferry said that the employee could not disseminate log-in credentials, while the dissenting judge examined whether the employee said yes when her former co-workers asked for the password.

I agree with Professor Kerr that the court reached the right result and that Nosal's accomplice liability conviction was appropriate. But as I read the dueling analyses before Kerr's cogent summary, it was quickly apparent that the case had the chance to be an extremely limited one. For starters, the case doesn't really seem to establish a rule for future application. As Judge Reinhardt notes in dissent, the holding seems to rely heavily on employment-related facts but the CFAA is not an employment law at all.

Professor Kerr then offers his take on where the case should have gone analytically and how the court could have bridged the two opinions. His take is that the  password sharing in the context of the "without authorization" standard really should have embraced an "agency/non-agency" distinction. In other words, because Nosal's co-conspirators used the current employee's password for their own purposes, there was no agency relationship among them. Kerr's argument looks principally to the initial delegation of authority (in Nosal II, that would be the computer access granted from employer to employee) and then to the subsequent conduct and whether it's outside the agency of the initial account holder. This, Kerr argues, would solve the "parade of horribles" laid out by the dissent, which extrapolate innocuous conduct into federal crimes. And in Nosal II itself, it would establish why the employee's grant of her log-in credentials to the ex-employees was "without authorization" - they couldn't have had an agency relationship at that point.

The CFAA, of course, remains a controversial law. Its use in garden-variety employment disputes may be waning in light of the federal Defend Trade Secrets Act. But it is still a potent weapon. What is notable about the plight of David Nosal is that it's not all that far removed from many fact patterns we see in civil cases. The conduct at issue was brazen, to be sure. Still, it seems awfully arbitrary that he has endured criminal prosecution for conduct that many others like him never would face. And on that score, the dissenting opinion's cautionary tale about the influence that Korn/Ferry's firm was able to muster is worth a read in its own right.

Second Circuit Adopts Narrow View of Computer Fraud and Abuse Act

As the Second Circuit wades into the long-simmering fray over the Computer Fraud and Abuse Act, I am starting to wonder if this is all worth the trouble. In other words, do we have reason to be concerned about the CFAA reaching seemingly innocuous conduct, or is the statute working as intended?

For those unfamiliar with the dispute over this once-obscure law, the statutory language "exceeds authorized access" has divided federal courts for more than ten years. The CFAA imposes both civil and criminal liability for those who exceed authorized access from a protected computer and obtain certain types of information. The term "exceeds authorized access" means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled to obtain or alter.

The dispute in employment contexts almost always arises when an employee, before leaving to compete, accesses a company database and digitally copies proprietary files (they do not have to be trade secrets under the CFAA). The employee's access is technically authorized, but if the employee acquires information contrary to his duty of loyalty and then misuses company data, some courts have held that this improper purpose qualifies as "exceeding" authorized access. Other courts take the opposite view.

An interesting (and very disturbing) case from the Second Circuit has fueled this split in authority. The case is not an employment case and involves a disgusting set of facts that I won't repeat. The case of United States v. Valle arose when a New York City police officer accessed a computer program called Omnixx Force Mobile, which allowed him to search restricted databases like the federal National Crime Information Center database, to gain sensitive personal information about an individual. The purpose of his access was to learn details about a woman the officer knew from high school, and whom he and a co-conspirator intended to kidnap. As such, the officer had no valid law enforcement purpose for accessing the database.

Reversing a conviction under the CFAA, the Second Circuit waded into the fray over the meaning of "exceeds authorized access" and the application of that statutory term to the officer's conduct. The court acknowledged a deep circuit split over the term's meaning and then took a deep, even nauseating dive, into the CFAA's legislative history. After going through that exercise, the court ultimately found that both the narrow and broad view found some support. And because of that, the court determined that a criminal statute had to be construed narrowly (the so-called rule of lenity).

The Second Circuit then adopted the "parade of horribles" approach, articulated by Judge Kozinski in United States v. Nosal. In that case, Judge Kozinski described the potential reach of the CFAA if the court had authorized a broad definition of "exceeds authorized access," a reach that would in his view criminalize a wide range of innocuous, everyday behavior. The examples include an employee using a computer to check Facebook, in violation of a corporate computer policy and similar conduct qualitatively different than that before the court.

Given the Second Circuit's adoption of a narrow view (and its agreement with the Fourth and Ninth Circuit), the circuit split over the CFAA's reach has become deeper. It is possible that U.S. Attorney Preet Bharara will seek to file a petition for writ of certiorari over this question. Though Congress in the past has entertained amendments to the CFAA, no legislative activity is imminent. In my view, Congress easily could find a middle ground between the two lines of authority to ensure that the CFAA does cover the type of conduct at issue in Valle and even civil cases that resemble some form of insider hacking or sabotage.

But even though I have in the past endorsed the narrow view of the CFAA, I question whether prosecutors are abusing the law. While the result in Valle seems wrong strictly in terms of justice, the Second Circuit's reversal in no way suggests that prosecutors overreached by charging Valle under the CFAA. Nor am I seeing an overuse of the CFAA in the civil context. Cases like Nosal, to be sure, seem more appropriate for a civil remedy. But are they outliers? Is the CFAA actually being used selectively, rather than punitively? If so, then perhaps we need not worry so much about individuals being hailed into court based on a "confused, accidental, or otherwise inappropriate use" of a database (the coin the phrase used by the dissenting judge in Valle). Maybe we have struck the right balance and done our best with an imperfect law that can, at times, be used effectively.

More Discord In Treatment of CFAA "Exceeds Authorized Access" Claims

The scholarship and divergence of opinion on the Computer Fraud and Abuse Act's reach has become so pervasive that the issues no longer seem as complex as they once did.

Most practitioners still are not familiar with the CFAA, and since it's buried in the criminal code, civil litigators shouldn't have much reason to learn the statute's intricacies. But since it's a federal statute that has criminal and civil reach, the CFAA occupies a somewhat unique place for trade secret and non-compete litigators. In essence, the CFAA can serve as the jurisdictional hook to get competition cases into federal court.

The statute is densely worded and a patchwork of amendments. But for simplicity it enables an employer to pursue a civil cause of action if an ex-employee took information out of a protected computer (essentially anything hooked to the internet) and caused damage or loss. There are permutations to the various sub-sections, but that's the CFAA's civil reach in a nutshell.

I wrote recently about another CFAA case that arose in the employment context, which I felt crystallized the deep split among courts about how to apply the statute when insiders access information to use it contrary to their employers' interests. The issue comes up often because it is easy to misappropriate information out of computers, and at least half of trade secret defendants get tripped up through electronic evidence.

But the actual language of the CFAA is not easy to apply. In the employment context, one can use it against an employee who access a computer "without authorization" or in a manner that "exceeds authorized access." This raises the question - not easily solved - of whether an employee who has the ability to access corporate information, but who intends to misuse it, really has violated the CFAA at all.

The case of American Furukawa, Inc. v. Hossain, 2015 U.S. Dist. LEXIS 59000 (E.D. Mich. May 6, 2015), provides a clear illustration of all the CFAA issues that crop up in employment cases. They include allegations of improper downloading of files to an external drive, planned competition, questionable conduct on the employee's part around the time of departure, and then the fortuitous discovery of actual competition through a misdirected e-mail. (Yes, auto-fill is a boon to the plaintiff's bar.)

With those allegations, the court allowed the CFAA claim to persist, even disagreeing with other courts within the same judicial district. In essence, the court gave deference to limitations the employer placed on computer access, use, and purpose. It held that the misuse of information in violation of policy or contractual limitations can give rise to an "exceeds authorized access" claim. Succinctly put, the court stated "such explicit policies are nothing but 'security measures' employers may implement to prevent individuals from doing things in an improper manner on the employer's computer system."

The opinion itself is notable for its harsh criticism of the decision in United States v. Nosal, a decision out of the Ninth Circuit that takes a very narrow interpretation of the CFAA and its "access" language. In fact, in several places, the district court cited the government's brief before the Ninth Circuit, in which it argued for a broad access definition. The case provides an interesting survey of the law surrounding the circuit split in the CFAA. And it further underscores the need for legislative reform or (less likely) a case to make its way to the Supreme Court.

New Ruling on Computer Fraud and Abuse Act Illustrates Division in Eleventh Circuit

The reach of the federal Computer Fraud and Abuse Act continues to divide courts and commentators. The friction spills over into statutory language that seemingly is pretty clear: one cannot access a protected computer to obtain information in a manner that exceeds the user's authorized access.

The phrase "exceeds authorized access" has yielded a split among many federal courts. On one side sits the pro-employer theory: that an employee cannot access information for reasons inconsistent with the employer's interest. On the other side, employees argue that the CFAA's definition does not turn on subjective intent as to use and that the statute only bars the accessing of information that the employer did not allow.

The Fifth and Seventh Circuits have pretty well-established rules that fall on the pro-employer side, though the rationales are not identical. The Fourth and Ninth are decidedly pro-employee and construe the CFAA much more narrowly.

The Eleventh Circuit's history on this is not straightforward.

Courts within the Eleventh Circuit (that is, district courts in Florida, Georgia, and Alabama) are divided on how to interpret and apply the CFAA. Some follow the pro-employee construction. Others disagree and side with the Fourth and Ninth Circuit line of authority. The problem seems to be a criminal case from the Eleventh Circuit itself, United States v. Rodriguez, which arguably requires a pro-employer construction of the CFAA.

Illustrating this divide is Enhanced Recovery Co., LLC v. Frady (opinion embedded below), which canvasses the law and decides not to follow Rodriguez - arguably binding precedent in the Eleventh Circuit. Frady involves perhaps the most common, ubiquitous CFAA fact pattern in employee mobility cases. The allegations hinged on an employee's act in preparing to compete by sending corporate documents from a company e-mail account to a personal web-based e-mail. Under the employer's theory, this transmission of e-mails is antagonistic to its business interests and constitutes the use of company information in an unauthorized manner.

As with many close CFAA cases, the fact pattern in Frady adds a twist because the employer had fairly clear policies against non-disclosure of information and a requirement to return company materials at the termination of employment. One reasonably could make the argument that these policies at least put the employee on notice that accessing corporate information for a prohibited use exceeded any authorization to use that information.

The district court in Frady was not persuaded and held this wasn't enough. In doing so, it seemed to tread a very narrow path through the Rodriguez case, which seems on first read to warrant a broader application of the CFAA.

My personal opinion is that something else must be going on here. I have seen judges walk this tightrope before, and I believe that regardless of any formal legal analysis, many remain troubled by the extension of the CFAA well beyond its intended purpose to punish hackers criminally. Courts, of course, acknowledge this but judges must default back to the statutory text to see whether conduct falls within the statutory proscription. And they are certainly bound by circuit law. In the CFAA arena, the distinctions that judges are drawing appear to be so fine and nuanced as to be meaningless.

This is not to say that the court in Frady got the result wrong as a normative matter, because the CFAA is overused. It is, to be sure, not a trade secrets law substitute - though many attorneys perceive that it is. And if the Obama Administration has its way, this divide over the meaning of authorized access will get cleaned up in a way that (surprisingly) favors the employer. Ultimately, I think this too is wrong. The existing legal framework under state law works just fine, and a federal trade secrets act may be okay too (though I am more lukewarm on that than others in my profession).

However, extending the CFAA and criminalizing conduct that doesn't even violate state trade secret law is not the right way to go about protecting intellectual property. In the employment realm, it remains a terrible fit. How judges get there is concerning, but if they agree, then I'm okay with a formal legal analysis that leaves me scratching my head.

Enhanced Recovery v. Frady (CFAA - Florida)

Obama Administration's Cybersecurity Proposal Would Broaden CFAA

The Obama Administration has been active in addressing concerns related to cybersecurity and trade secrets theft. In 2013, the Administration rolled its strategy to mitigate trade secrets theft - the first of its kind executive-level white paper that specifically identified trade secrets protection as part of a national economic security strategy.

In January of this year, the Administration went further than I anticipated by endorsing amendments to the somewhat controversial Computer Fraud and Abuse Act. As readers of the blog know, the CFAA can be a jurisdictional hook to bring trade secrets claims into federal court. It is broader than trade secrets law in some respects (it protects unauthorized access of any information contained in a protected computer, not just trade secret information) and much narrower in others (it contains a $5,000 damage or loss requirement).

Part of the controversy surrounding the CFAA has involved statutory language that bars someone from accessing a computer in a manner that "exceeds authorized access." That language has given courts fits, with circuit courts applying different interpretations to the statutory language. The controversy crystallized in United States v. Nosal, a federal prosecution of a Korn-Ferry executive recruiter that brought to the fore the various CFAA interpretations of "exceeds authorized access." My take on Nosal and a summary of circuit court treatment of the issue is found in this post.

The Administration's proposed set of amendments to the CFAA cuts against the Nosal approach and resolves a question where there's a split of authority: whether "exceeds authorized access" includes the misuse of information even if access to it was technically permitted. Example: copying data from a work computer to a personal thumb-drive for use at a new job.

The amendment would define "exceeds authorized access" to mean "to access a computer with authorization and to use such access to obtain or alter information: (a) that the accesser is not entitled to obtain or alter; or (b) for a purpose that the accuser knows is not authorized by the computer owner." Part (b) is the Nosal amendment and would resolve the circuit split in favor of what the employer-friendly jurisdictions, like the Seventh and Eleventh Circuits, endorse.

The impact of this proposed amendment is uncertain. On the one hand, if adopted, it almost surely would mandate corporate counsel to draft a computer usage policy so that a court would have some objective indication of what the computer owner authorizes.

On the other, it criminalizes a range of activity well below trade secrets theft, since there is no requirement that the information accessed be a trade secret or even lesser-protected "confidential" information. As long as the company can establish a value in excess of $5,000, the CFAA would apply. And on that score, the CFAA contains nothing to limit how a computer owner can establish that particular information is worth $5,000.

For a comprehensive take on the Administration's proposal, see Professor Orin Kerr's January 14 article in the Washington Post.

2013: The Top 10 List (Part II)

I hate to see 2013 leave, so I stretched my annual year-end review into two parts. Yesterday, I discussed the first half of my top 10 developments in non-compete and trade secret law. And today, I conclude the year with numbers one through five.

Here we go....

5. Aleynikov's Advancement Victory Highlights Oft-Overlooked Issue in Competition Suits. Former Goldman Sachs code developer has the distinction of making the Top 10 list in back-to-back years. (He is, in essence, the Arcade Fire of trade secrets litigants.) In last year's post, I summarized his legal high-wire act and predicted that he just might win his indemnification and advancement suit against Goldman Sachs. Well, he prevailed at least in part, with a federal district court finding that Aleynikov is entitled to have Goldman advance his legal expenses to fight the ongoing state criminal case in Manhattan. This development is significant because advancement and indemnification rights are the soft underbelly of many competition cases and often can throw a wrench into a company's plans to fight unfair competition. States recognize the broad policy goals of advancement and indemnity and will apply these statutes liberally to further those goals. Aleynikov's case, and others like it, should teach plaintiff's counsel to carefully consider how to plead and pursue competition claims. For a recap of Aleynikov's win in New Jersey, read my post from last month.

4. Federal Court Convicts David Nosal of Computer Fraud. The Computer Fraud and Abuse Act continued to wreak havoc on logic and reason (and more than a few lives) in 2013, and the case of David Nosal is one such example. The former Korn/Ferry search executive was convicted for violating the CFAA and the general federal conspiracy laws in California federal court. Nosal's plight (he will again appeal) indicates that conduct often giving rise to civil claims for unfair competition can actually result in criminal charges. Nosal's conviction generated a fair amount of controversy and demonstrates the broad applicability of the CFAA. For a discussion of the Nosal conviction, listen to the Fairly Competing podcast that John Marsh, Russell Beck, and I produced and posted back on May 28.

3. Illinois Appellate Court Issues Controversial Fifield Decision. No single non-compete has generated more buzz than the Appellate Court of Illinois' opinion in Fifield v. Premier Dealer Services. The case holds that a non-compete given in exchange for employment is not sufficient consideration unless the employment continues for at least two years. (To those unfamiliar: this is a case not legislation. I know it's confusing.) The rule broadly impacts at-will employees and has caused business counsel to lose sleep and wring their hands over just how to draft employment contracts. The Supreme Court of Illinois tacitly approved of the holding, declining to take the petition for leave to appeal. They were not persuaded, apparently, by my "dissenting opinion" in Fifield as the phantom Fourth Justice. (For those of you interested in assessing blogging metrics, this post - by a factor I can't even count - generated the most hits, the most e-mails, two news magazine interviews, and three citations in opposing counsel's legal briefs.) For my follow-up take, you can read more on Fifield here. (And if you want even more, just Google "Fifield." You'll find plenty.)

2. Seventh Circuit Decides Tradesmen Int'l v. Black. My case. Navel-gazing. Can say no more. Read here and here.

1. Federal Legislation to Protect Trade Secrets on the Horizon? Number one is a runaway. Not even close. It is difficult to overstate the importance of many proposed bills that are currently working their way through committee or that could be reintroduced in some form or fashion. Of particular note in 2013 was "Aaron's Law", which Zoe Lofgren introduced to cut back on the perceived unfairness and breadth of the CFAA. John, Russell, and I discussed the CFAA prosecution of activist Aaron Swartz on our Fairly Competing podcast early this year. Rep. Lofgren also introduced the Private Right of Action Against Theft of Trade Secrets Act, which would create a private civil cause of action at the federal level. Other legislative activity at the federal level included introduction of the Deter Cyber Theft Act, which would establish a "watch list" of countries that engage in cyber theft and require border patrol to bar imports from those countries. My June 4 discussion of the Act can be found here. Finally, and most recently, Senator Flake introduced the Future of American Innovation and Research Act. This legislation would provide a federal trade secrets remedy against those acting outside the U.S. or for the benefit of a foreign actor. It also provides for an ex parte seizure order, subject to some limitations. And finally, if you're interested in listening to further discussion about the federalization of trade secrets law, listen to the podcast John, Russell, and I produced on May 17.

***

That's a wrap on 2013. Again, many thanks to my readers and those who are kind and thoughtful enough to e-mail me. You have made this a truly enjoyable experience once again. A less warm farewell for the year to those spammers who have ruined the commenting portion of this blog permanently. Such is life on the internet.

I am looking forward to starting Year 6 and reaching that milestone of post number 500. See you in 2014!

Even Reprehensible Terms of Service Violations Do Not Yield CFAA Claim

Although the Computer Fraud and Abuse Act frequently has been described as extremely broad in reach, it's also important to recognize its limitations.

One of the most substantive, sweeping limitations involves potential violations of website "Terms of Use" or "Terms of Service." Largely as a result of the case law that has developed out of the Ninth Circuit Court of Appeals, courts have recognized that pursuing a CFAA claim (or prosecuting a CFAA crime) on the basis of TOS violations poses significant problems.

The CFAA, somewhat famously, prohibits access to a protected computer without authorization or (critically) in a manner that "exceeds authorized access." Shoehorning a TOS violation into the "exceeds authorized access" framework has caused a great deal of handwringing among academics, prosecutors, defense attorneys, and judges.

The most well-known case involved Lori Drew, the MySpace Mom who created a fake account to contact a 13-year-old girl with whom her daughter was friends. The girl later committed suicide after corresponding with a person she thought to be a 16-year-old boy, the identity Drew assumed online with the fake account. After the U.S. Attorney's Office prosecuted Drew under the CFAA for a TOS violation, the district court judge threw out the conviction and held that the CFAA - as applied in the case - was void for vagueness. (Professor Orin Kerr represented Drew in this case.)

A similar dust-up ensued in an Oregon middle school recently, when a number of students created fake Facebook and Twitter accounts under the name of their assistant principal, Adam Matot. The students would then invite children to be friends with "Matot", and upon receiving an acceptance of the invitation, they would send the children obsene material (including pornographic images).

Matot's grievance, however sympathetic, simply did not state a CFAA claim for many of the same reasons the government couldn't maintain a conviction against Drew. The TOS violation, under Ninth Circuit law (Matot filed suit in Oregon), was not enough to demonstrate that the children exceeded their authorized access to a computer, since that statutory term restricts only access to a protected computer - not the misuse of information contained within the protected computer.

It is important to remember what function website terms of service play in commerce. As Professor Kerr mentioned in testimony before the U.S. House of Representatives, "[c]ompanies write those [TOS] conditions broadly in part to avoid civil liability if a user of the computer engages in wrongdoing....Those terms are not designed to carry the weight of criminal liability."

The same analysis generally will apply to civil claims involving the CFAA. In a majority of federal jurisdictions, courts will look at whether an individual had permission to use a protected computer in the first place and will not focus on whether the individual's use of information was wrongful.

Revisiting "Damage" and "Loss" Under the Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act is organized about as logically as David Foster Wallace's sprawling masterpiece, Infinite Jest.

For literary fiction, that might be fine. For federal statutes, it's a disaster.

As a result, courts and commentators long have struggled over what parties must prove to establish an actual civil claim under the CFAA. And a great deal of the confusion and disagreement concerns the twin concepts of damage and loss.

At first blush, the terms sound like synonyms. But they're not. For purposes of the CFAA, each term has a precise definition.

The basic confusion has arisen because to state a civil claim, a party must have suffered "damage or loss" by reason of a substantive offense. To compound problems, certain substantive CFAA provisions require a party independently to show "damage," which renders the either/or structure a bit confusing. And a textual reading of the CFAA seems to show that in all cases (really, in all cases that deal with unfair competition) a plaintiff must show compensable "loss."

In other words, it's a total nightmare.

Or is it?

In my opinion, the concepts of damage and loss are complimentary pieces that fit together. They're not substitutes. But to understand this, it's critical to keep in perspective the overall purpose and set-up of the CFAA.

What the CFAA Does (and Doesn't) Protect?

Attorneys too often view the CFAA as a federal trade secret substitute. In other words, attorneys who want the muscle of a federal court try to shoehorn a trade secrets (or duty of loyalty) case into a CFAA violation if they determine a computer somehow was involved in facilitating the underlying act (usually, the downloading of documents). As a result, a large majority of CFAA claims in the employment context never quite fit the elements of the statute.

The CFAA protects a party from damage to computer systems (including files and programs), outside hacking, and theft of computer data. That's it. It is not a broad federal statute that displaces a wide range of contract- and tort-based claims typically reserved for state courts. And because computers are omnipresent in the way parties deal with each other, a broad CFAA construct could have the effect of federalizing competition claims well outside the statute's intent. This is part of the ongoing dispute over the CFAA's reach, a subject on which I and countless others have written.

The Concept of "Damage"

The definition of "damage" under the CFAA is decently plain. Damage is simply the impairment to the availability or integrity of data. For example, if an outsider hacks into a network and causes the deletion of files from a server, this would constitute damage. If an insider copies confidential information that otherwise remains available, this would not constitute damage because the data is still available. I'll return to this, but the word "integrity" is the key to unlocking the confusion that has arisen over when certain conduct causes damage.

Here's an easy way to understand "damage" for CFAA purposes: it's the type of injury the statute was designed to cover. As I'll discuss, the relatively limited statutory definition becomes confusing when applied to data theft cases.

Defining "Loss"

"Loss" is not the same as damage. Where damage defines the nature of the harm, "loss" covers what is compensable arising from that harm. Loss covers either: (1) costs in restoring a computer system, programs, or files; or (2) revenue lost due to an interruption in service.

A couple of examples may help clarify. If an outside hacker launches a denial-of-service attack on an e-commerce website, he can be liable for the revenue lost attributable to server downtime. Similarly, if an insider destroys the only copy of files on a shared server, she can be liable for the costs the company spends to hire a forensic technician to recover those files. These are the classic CFAA offenses.

Understanding the Types of CFAA Cases

The problem in fitting together the concepts of "damage" and "loss" arises from the predicate to Section 1030(g). This is the section of the CFAA that enables a private party to assert a civil claim.

The predicate starts off by stating unambiguously that a party "who suffers damage or loss" for an enumerated offense can maintain a civil cause of action. In reality, that language is either unnecessary or improperly worded. I maintain it's unnecessary.

The Destruction or Hacking Cases

Several provisions of the CFAA independently require a civil plaintiff to show "damage." I refer to these provisions, for simplicity sake, as the data destruction or hacking offenses. They are contained within Sections 1030(a)(5)(A)-(C). By and large, these sub-sections of the CFAA are easy to understand. They include the paradigms I described above: the outsider launching a denial-of-service attack and an insider destroying files.

In these fact patterns, which Section 1030(a)(5) clearly is designed to redress, a court first assesses whether the activity gives rise to "damage" - that is, data or system impairment - and then looks to whether the plaintiff can establish "loss." It makes little sense to view this as an either/or proposition because loss (response costs or lost revenue due to an interruption in service) flows naturally from damage. If a party can show damage, it will show loss (unless the amount is so trivial as to fall short of the CFAA's modest $5,000 jurisdictional minimum).

The Theft Cases

The other provisions of the CFAA that are frequently at issue in competition cases are Sections 1030(a)(2) and (a)(4). Those sub-sections have caused a great deal of dispute among federal courts because of the concept of "access" and whether "unauthorized access" includes misuse of data. Aside from that, both sub-sections generally provide a remedy if a party lacks proper access (however interpreted) and obtains information from a computer either with or without an intent to defraud.

The best way to look at these provisions of the CFAA is that they serve different ends than the destruction or hacking provisions of Section 1030(a)(5). In other words, Sections 1030(a)(2) and (4) provide a remedy for civil theft out of a computer. In the context of these claims, a party is not going to show "damage" to a computer because the very nature of the offense doesn't contemplate system downtime or lost files - unless we reinterpret "damage", which I argue below we must. Rather, the claim deals with the taking of information (trade secret or not). But, by virtue of the claim, the owner still has the same data (or else it simply would be a Section 1030(a)(5) claim).

From my perspective, a plain reading of the CFAA requires a plaintiff to show loss in virtually any CFAA case involving unfair competition. But since loss appears limited to damage assessment, recovery costs, and lost revenue due to a service interruption, assessing loss in a "theft" case is much more difficult to grasp. The computer isn't damaged; the data isn't gone; and the server hasn't crashed.

For this reason, courts seem to have stretched the meaning of "loss" to include the cost of retaining a forensic expert to track wrongdoing. And in the context of a CFAA theft case under 1030(a)(2) and (a)(4), this may be a "cost responding to an offense." But it's awfully difficult to fit that into the definition of "loss" unless we do more work to reconcile the CFAA as a whole. This issue receives little attention because there's so much noise surrounding the other elements of a theft case, in particular whether the term "unauthorized access" can apply to insiders who have credentials to use a computer system but act in ways contrary to their employers' interests.

Reconciling "Damage" and "Loss" Under the CFAA

As it stands, here's what seems clear. For a hacking or data destruction case under Section 1030(a)(5), a plaintiff must show damage and loss. This is based simply on a textual reading of the statute. Loss should flow naturally from damage. These are not difficult cases to understand, which is hardly a surprise given that they fall within the statute's prime focus.

A theft case is different. A plaintiff needs to show a loss, but it does not have to show damage. That much also seems clear from the plain language of the statute. Practically speaking, though, should it prove damage? I think so.

But to do this in a theft case arising under Section 1030(a)(2) or (4), a court would have to interpret "damage" as a compromise to the manner in which data was stored or protected. Arguably, this is consistent with the statutory definition, which references an impairment to the integrity of data.

Then, of course, the plaintiff still would need to show a loss. To me, it's difficult to argue loss without showing damage because (as I've noted) the concepts seem to be complements - not substitutes. Plaintiffs have figured this out by engaging forensic firms to track unauthorized access and stolen information out of a protected computer. I'm not totally convinced this is an expense that qualifies as a "loss," but if courts expand the definition of damage, then I guess "loss" would have to include investigation expenses. Regardless, it's not a totally unreasonable reading of the statute to include these expenses.

Ultimately, courts have little choice. They have to expand the definition of damage to give meaning to Section 1030(a)(2) and (4). Otherwise, if damage and loss are given a narrow reading, there's no claim under the CFAA for theft cases. It's easy to say now that the definitions simply don't match up, but it would be absurd to find there's no way to define damage for theft cases.

This expansive definition of damage may solve the riddle that confronts cases involving theft of data. More to the point, it demonstrates precisely why CFAA theft cases (as opposed to hacking or data destruction cases) should be limited to access by outsiders - those who truly don't have the credentials to access data in the first place. This is another way of saying the narrow view of what unauthorized access means is consistent with the purpose of the statute and in particular the concepts of damage and loss. Otherwise, the CFAA is little more than a substitute for state laws that already govern trade secrets theft and breach of the duty of loyalty. And given that the CFAA contains broad criminal sanctions, this is an interpretation courts should be very hesitant to adopt.

My Issue With PRATSA: The Rule of Lenity

For the most part, I am deferring extended discussion of the proposed new trade secrets law to my (friendly) competitors, John Marsh of Hahn Loeser and Robert Milligan/Josh Salinas of Seyfarth Shaw. Their posts are excellent and insightful, as usual.

In short, the Private Right of Action Against Theft of Trade Secrets Act (PRATSA) creates a federal civil cause of action for trade secrets misappropriation, something commentators have debated for years. So, too, by the way, did the Fairly Competing hosts - John Marsh, Russell Beck, and me - several weeks back!

As John described in his post, PRATSA is a companion law to Aaron's Law - legislation that would narrow the reach of the Computer Fraud and Abuse Act and eliminate its application to garden-variety misappropriation claims in the workplace. John aptly describes PRATSA and Aaron's Law as a trade-off in that PRATSA expands the potential remedies for trade secrets theft, while Aaron's Law limits the CFAA to traditional forms of computer hacking.

In its current form, PRATSA is styled as an amendment to the Economic Espionage Act, which is in Title 18 of the United States Code dealing with crimes and criminal procedure. And - much like the CFAA (also housed in Title 18) - it would graft onto the statute a civil remedy. The problem, in my opinion, is something known as the rule of lenity.

The rule of lenity is fairly simple in concept: in construing a criminal statute, a court must interpret any ambiguity in favor of the defendant. In CFAA cases, many courts have applied the rule of lenity to narrow the reach of the statute and limit the types of activity that exceed authorized access to a protected computer under the statute. Put simply, the rule of lenity is a thorn in a CFAA plaintiff's side because a defendant simply can rely on a time-honored rule of construction to argue for a narrow interpretation. That argument has worked very well.

The same problem potentially exists with PRATSA.

As Robert and Josh identify in their discussion, the bill does not address many substantive issues - such as damage remedies and fee-shifting. Without further amendments (which seems unlikely), a defendant could argue that common remedies available under state trade secrets law (such as royalty damages) are not available under the rule of lenity. That may discourage plaintiffs from using PRATSA, since it would not displace state civil trade secrets laws.

If PRATSA were to move forward through committee, it seems inevitable that some of the deficiencies would be addressed.