United States v. John (2010)
| Industry | Financial services |
|---|---|
| Headquarters | United States |
In United States v. John, 597 F.3d 263 (2010), the United States Court of Appeals for the Fifth Circuit examined the meaning of "exceeds authorized access" under the Computer Fraud and Abuse Act (18 U.S.C. §1030(e)(6)) and determined that access is exceeded when it is utilized beyond the scope of granted permissions. The court held that an employee surpasses authorized access when using it to obtain or misappropriate information as part of a criminal enterprise.
This ruling delineates the boundary between permitted computer access and improper use of information accessed under the CFAA.
Background
Dimetriace Eva Lavon John served as an account manager at Citigroup for approximately three years, during which she had authorized entry to internal systems containing customer account details.
In September 2005, John disclosed information from no fewer than seventy-six corporate customer accounts to her half-brother, Leland Riley. She extracted this data from Citigroup’s internal network and provided scanned checks or printed documents with comprehensive account information.
Riley, along with accomplices, exploited this data to carry out fraudulent transactions on four customer accounts, resulting in losses totaling $78,750.
John was found guilty in the United States District Court for the Northern District of Texas on charges including:
- conspiracy to commit access device fraud (18 U.S.C. § 371);
- fraud involving access devices and aiding and abetting (18 U.S.C. §§ 1029(a)(5) and (2));
- exceeding authorized access to a protected computer (18 U.S.C. §§ 1030(a)(2)(A) and (C)).
On appeal, John contended that her use of Citigroup’s computer system was authorized as an employee and that the CFAA does not criminalize improper use of information lawfully accessed through authorized computer use.
Exceeding authorized access to a protected computer
The case focuses on whether an employee with permission to access an employer’s internal computer system for job-related purposes can be charged under 18 U.S.C. § 1030(e)(6) for wrongful use of information she was entitled to access.
The Fifth Circuit analyzed whether "authorized access" encompasses restrictions on how information obtained through permitted access may be used.
Section 1030(e)(6) defines "exceeds authorized access" as accessing a computer with permission but utilizing that access to acquire or modify information which the user is not entitled to obtain or alter.
John argued that her authorization extended to using Citigroup’s system and viewing or printing customer account data as part of her responsibilities. She asserted that the CFAA prohibits unauthorized acquisition of information but does not address misuse of data legitimately accessed.
Judicial interpretations of "exceeding authorized access" vary.
In LVRC Holdings v. Brekka, the Ninth Circuit held that an authorized user does not exceed authorization simply by acting contrary to the owner’s interests; rather, exceeding authorization occurs only when accessing or modifying information they are not permitted to obtain. In this case, LVRC sued former employee Christopher Brekka for emailing confidential company files to himself and his wife in preparation for competing with LVRC after his departure. The Ninth Circuit concluded Brekka did not exceed authorized access under § 1030(a)(2) or (a)(4) since he had legitimate access during employment. This established that breaching employer-imposed restrictions on data usage does not necessarily violate the CFAA if the initial access was authorized.
In contrast, in EF Cultural Travel BV v. Explorica, Inc., the First Circuit interpreted "exceeding authorized access" as going beyond the intended purposes for which permission was granted. Former employees breached confidentiality agreements and utilized proprietary EF information to develop competing software, thereby violating § 1030(a)(4).
Fifth Circuit analysis
The Fifth Circuit upheld that computer access is defined by the boundaries set within the employment agreement; however, an employee might still possess authorization even if their computer use contradicts employer-imposed restrictions. The court highlighted that access may be exceeded when utilized beyond the permitted objectives. It ruled that explicit limitations on computer usage are enforceable, particularly when such access facilitates unlawful activity.
Although John had permission to view and print data on Citigroup’s system, her utilization of it to execute fraudulent transactions went beyond the authorized scope. Her access was constrained by company rules, which she deliberately breached by retrieving customer account details outside her management responsibility, extracting confidential information, and perpetrating fraud against both Citigroup and its clients.
The court determined that John surpassed authorized access under the CFAA because she intentionally disregarded internal regulations and participated in an illicit scheme.
Decision
The court upheld John’s convictions but set aside her sentence due to the district court’s failure to provide adequate justification and properly assess the applicable sentencing guidelines. The matter was sent back for additional proceedings.
See also
- Computer Fraud and Abuse Act
- LVRC Holdings v. Brekka
- EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577 (2001)
- United States v. Nosal
- Computer Crime Law, 2d, St. Orin S. Kerr, Paul, MN : Thomson West, 2009.
- Software and Internet Law, Mark A. Lemley et al., 4th Edition 2011, Wolters Kluwer.
- Orin Kerr "Should Faking a Name on Facebook Be a Felony?," Op-Ed., Wall Street Journal, Sept. 14, 2011.