United States V. Nosal
Background: What is the Nosal Case About?
David Nosal was a former employee of an executive search firm.
He convinced former colleagues to access the company’s confidential database and provide him with information after he left.
The legal question: Did this constitute “unauthorized access” under the CFAA?
1. United States v. Nosal (2012, 9th Cir.)
Facts:
Nosal left his job and started a competing firm. He persuaded former coworkers to use their authorized access to the company’s database to gather confidential information for him, violating company policy but not hacking or using stolen credentials.
Legal Issue:
Does violating employer computer use policies count as "exceeding authorized access" under the CFAA?
Court’s Ruling:
The 9th Circuit ruled no.
The CFAA’s "exceeds authorized access" means accessing areas of a computer the user is not allowed to access—not merely violating use policies.
Simply using authorized access for an improper purpose (like sharing info) is not a criminal CFAA violation.
Significance:
Narrowed CFAA scope, protecting employees who misuse info they are allowed to access.
Prevented criminalizing routine breaches of workplace computer policies.
2. United States v. Auernheimer (2014, 3rd Cir.)
Facts:
Auernheimer discovered a security flaw exposing user data on AT&T’s website and accessed it without authorization.
Legal Issue:
Whether accessing publicly available but poorly secured data is “unauthorized access” under CFAA.
Ruling:
The court held that accessing publicly accessible data does not violate CFAA.
For access to be unauthorized, there must be a technical barrier or restriction.
Connection to Nosal:
Like Nosal, Auernheimer limits the scope of CFAA to technical access restrictions, not just policy violations.
3. United States v. Drew (2009)
Facts:
Drew created a fake MySpace profile to harass a teenager, violating MySpace’s terms of service.
Legal Issue:
Does violating terms of service constitute a CFAA violation?
Ruling:
The court ruled no.
Violating website terms is not criminal hacking under CFAA.
Connection:
Echoes Nosal’s approach that policy violations alone don’t trigger criminal liability under CFAA.
4. LVRC Holdings LLC v. Brekka (2009, 9th Cir.)
Facts:
An employee used company info after resignation, raising questions about unauthorized access.
Legal Issue:
Did the employee "exceed authorized access" by using info after leaving?
Ruling:
Access was authorized while employed.
Using info for an improper purpose does not equal unauthorized access under CFAA.
Relation to Nosal:
Reinforces Nosal’s limitation on the CFAA: focus on access, not use.
5. United States v. Valle (2015)
Facts:
Valle, a police officer, accessed law enforcement databases for unauthorized personal use.
Legal Issue:
Does accessing info for improper personal reasons violate CFAA?
Ruling:
The court held Valle’s conduct violated CFAA because he accessed information he was not entitled to.
How it differs:
Unlike Nosal, Valle accessed data he was not authorized to view—so CFAA applied.
Summary: What Nosal and Related Cases Teach Us
| Case | Key Takeaway |
|---|---|
| Nosal (9th Cir.) | Violating company policy ≠ CFAA violation if access is authorized. |
| Auernheimer | Accessing publicly available data ≠ CFAA violation. |
| Drew | Violating website terms ≠ CFAA violation. |
| Brekka | Use of info beyond authorization ≠ unauthorized access if access itself was authorized. |
| Valle | Accessing data outside one’s rights = CFAA violation. |
RELATED Blog
0 comments