A federal judge in the United States District Court for the Eastern District of Missouri issued a ruling affecting the remedies an employer may seek when a departing employee misappropriates information stored electronically in Lasco Foods, Inc. v. Hall and Shaw Sales, Marketing, & Consulting, LLC.1 The court broadly interpreted the Computer Fraud and Abuse Act (CFAA),2 paving the way for a federal remedy for employers whose former employees delete and/or steal company information.
Factual and Procedural Background
Individual defendants Charles Shaw and Ronald Hall were employed by the plaintiff Lasco Foods, Inc. in managerial positions. When Hall and Shaw left the employ of Lasco, they formed defendant Hall and Shaw Sales, Marketing & Consulting, LLC. Lasco filed a complaint with several counts, including a count that defendants violated the CFAA, and seven other claims under state law. Lasco alleged that Hall and Shaw failed to return their laptop computers, issued by Lasco, for 38 and 70 days, respectively, after Lasco demanded their return. Lasco further alleged that Hall and Shaw copied or downloaded confidential and trade secret information and then deleted that information prior to returning their laptop computers. The defendants filed a motion to dismiss Lasco's two federal claims (Lasco also brought a claim under the Stored Wire and Electronic Communications Act) for failure to state a claim, and the seven state law claims for lack of jurisdiction.
The defendants argued that Lasco failed to plead the requirements for a CFAA claim. The CFAA allows a cause of action for any person who suffers damage or loss by a violation of the act, so long as the damage sustained during a one-year period aggregates to at least $5,000 in value.3 Although there is dispute among courts whether a plaintiff must show both damage and loss for a successful CFAA claim, here, the court found that Lasco had plead facts showing both.
The CFAA defines damage as "any impairment to the integrity or availability of data, a program, a system or information."4 The court in Lasco found that Lasco's allegations that defendants Hall and Shaw deleted electronically stored confidential and trade secret information from their computers were sufficient allegations of damage under the CFAA. It is important to note that there were no allegations that the defendants deleted information from Lasco's computer network or system, but only from their personal computers issued by Lasco.
The CFAA defines loss as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service."5
The court found that Lasco plead sufficient loss with its allegations that defendants deleted information, requiring forensic analysis and other remedial measures to retrieve and analyze defendants' computers and restore the data. The court's approach, which did not require that information be destroyed on the employer's network computer, reflects a broader interpretation of CFAA than the interpretation in International Airport Centers, L.L.C. v. Citrin.6
Further, the court found that the losses allegedly resulted from an interruption in service, as required by the CFAA. The court found that an interruption in service occurred when the defendants refused to return their computers for a combined 108 days, and there was further interruption in order to perform a forensic investigation to determine what information the defendants deleted.
Although the court ultimately dismissed Lasco's CFAA claim because Lasco failed to sufficiently plead that defendants accessed Lasco's information without authorization or exceeding authorized access, this was simply a pleading deficiency which Lasco has now corrected so the case will proceed through the trial court.
Implications for Employers
The Lasco opinion is good news for employers, particularly those located within the Eastern District of Missouri, that desire to pursue claims in federal court against former employees who take or destroy information stored on company computers when they are fired or when they quit. Under the CFAA, a federal cause of action may be available to employers, and federal courts are many times more stringent in the enforcement of employer's trade secret than state courts. In a time of layoffs and an uncertain economic future, access to federal courts to remedy theft of trade secrets and employer proprietary data is more important than ever. For example, a February 2009 study by the Ponemon Institute shows that 59% of departing employees steal company data, and 67% of those former employees use the information as leverage for a new job. At a minimum, an employer should take precautions to protect its information and complete a careful inventory of its electronic information upon an employee's departure.
Lasco also makes it easier for employers to satisfy the CFAA's $5,000 loss threshold by relying on the cost of computer forensic expert fees and the delay in return of company property, such as laptop computers, in addition to any loss caused by the actual misuse of information. Further, the employer is not required to establish, as in Citrin, that the data was permanently deleted from the employer's computer system.
Footnotes
1 600 F. Supp. 2d 1045 (E.D. Mo. 2009).
2 18 U.S.C. §§ 1030, et seq.
3 18 U.S.C. §§ 1030(g), 1030(c)(4)(A)(i)(I).
4 18 U.S.C. § 1030(e)(8).
5 18 U.S.C. § 1030(e)(11).
6 440 F.3d 418, 419 (7th Cir. 2006) ("deleted files [that] are easily recoverable" create no CFAA violation) and most of its recent progeny.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
