computerwoche.de

Archiv

Worker had proper access when he snagged corporate data, court rules

06.09.2012
In a decision likely to be sobering for companies fighting insider threats, an appeals court has ruled that an employee who used his valid computer access rights to access data from his employer can't be prosecuted under a federal anti-hacking law.

The case involves Mike Miller, a former project director at WEC Carolina Energy Solutions, in Rock Hill, S.C. Miller and his assistant Emily Kelley allegedly downloaded proprietary data from WEC's computers just before they resigned in April 2010.

Miller is accused of using the data to win business for his new employer, a WEC rival.

WEC sued Miller and Kelley for violating nine state laws and the Computer Fraud and Abuse Act (CFAA), a federal anti-hacking statute passed in 1986. The law basically provides for criminal penalties against individuals who access computers without authorization. It's typically used to prosecute external hackers who break into a computer to steal data or do sabotage.

In its October 2010 lawsuit, WEC claimed that Miller illegally downloaded the company's confidential and trade secret documents, including those with details on pricing terms and pending projects to Miller's laptop.

The company argued that Miller and Kelley breached the company's computer use policies when they grabbed the data. WEC maintained that because of the policy breach, Miller lost his authorized access and was therefore liable under CFAA.