In a recent court case U.S. v. David Nosal, Judge Alex Kozinski ruled that the Computer Fraud and Abuse Act (CFAA), the nation’s anti-hacking law, applies to people accessing data by circumventing technological access barriers, but it does not extend to employees violating their employer’s restrictions on the use of that information. Under the new interpretation, an employee who has valid credentials to access company data and then misuses that data, however inappropriately, cannot be prosecuted under the CFAA. However, an employee who has valid credentials to access a company computer, but hacks into company data for which he does not have authorization can be prosecuted under CFAA.
The reason for the new interpretation, according to the ruling summary, was that using the CFAA to take action against employees that violate use restrictions could lead to prosecution...