Logging into Facebook, perusing eBay and surfing to other decidedly non-work related sites may not just upset your boss; it could also be a federal offense.
That's according to two Boston College professors who recently authored a paper on how a broad interpretation of the 1986 Computer Fraud and Abuse Act (CFAA) could criminalize the routine behavior of every employee who uses a workplace computer in their job.
As the First, Fifth, Seventh and Eleventh Circuit Courts of Appeal interpret it, a breach of a company's computer policy for example a ban on accessing dating sites and social media for example, also constitutes a violation of the CFAA.
The law was originally written to punish and deter criminal hacking, but as technology experts point out, innovation in technology has outpaced the laws that govern it.
The CFAA, a 1986 law that predates HTTP and the Web as we know it, makes it a crime to "access a computer without authorization or exceed authorized access ... from [a] protected computer." Based on the law's own definitions, a "protected computer" is virtually any device with a microprocessor and a network connection. Today, virtually everyone "accesses" one when they point their browser to any webpage.
Since the law allows private right of action, companies could, in theory, successfully sue their employees for any computer policy violation, even something as benign as sending your spouse an email about being late for dinner.
In their paper, published in the American Business Law Journal, Professors Stephanie Greene and Christine Neylon O'Brien also discuss United States v. Nosal, in which the former employee of an executive recruiting firm was prosecuted under the CFAA after he conspired with then-current employees to give him the company's proprietary information with the intention of setting up a competing business.
In a break from its sister courts, the Ninth Circuit accepted a much narrower interpretation and said even though defendant David Nosal misused company resources and broke the company's computer policy, he did not "exceed authorized access" and was not in violation of the law.
Last month, notorious troll and hacker Andrew Auernheimer was convicted under the CFAA for "stealing" email addresses and corresponding names from an AT&T database. While it did take some technical knowledge and ingenuity to access the data, Auernheimer never guessed passwords, which is a crime, nor did he write the script that made obtaining the information possible. Experts on technology, privacy and policy have decried his conviction under such a broad interpretation of the law.
"The Ninth Circuit appears to be at the forefront of a new trend that recognizes dangers in the CFAA as a catch-all statute to pursue employees for fraudulent or disloyal use of workplace computers," O'Brien and Greene wrote.
This story was provided by TechNewsDaily, sister site to LiveScience.
