US Court of Appeals rules that violating employer's computer use policy is not a crime under Computer Fraud and Abuse Act
Jamie Williams / Electronic Frontier Foundation :
Context & Ripple Effects
This ruling is an early marker in a years-long judicial tug-of-war over how far the [[a:#|Computer Fraud and Abuse Act]] reaches. The court here draws a line at the workplace: breaking an employer's computer-use policy is a firing offense, not a federal crime. That position was contested from both sides in the following years — an appellate ruling soon after gave prosecutors broad leeway to charge password theft, while EFF and other critics warned it could criminalize routine password sharing.
The arc bends toward narrowing: by 2020 a federal court held that merely violating a site's terms of service is not criminal hacking, and in 2021 SCOTUS confirmed the statute cannot be used against people who misuse databases they are otherwise entitled to access. The 2015 decision reads today as one of the first court rulings to separate contractual policy breaches from genuine unauthorized access.
First-order effects
- Employees caught misusing work computers in violation of company policy lose their main exposure to felony prosecution under the CFAA — enforcement shifts entirely to employers' HR and disciplinary processes.
- Federal prosecutors lose a lever they had used to convert workplace computer misuse into hacking charges; cases built on 'exceeded authorized use' grounds face a higher bar.
Second-order effects
- Employers seeking deterrence beyond termination must lean on civil remedies — trade-secret suits, breach-of-contract claims — rather than criminal referral, changing the cost calculus for pursuing aggrieved workers.
- Security researchers gain operational room: probing systems they can legitimately reach carries reduced risk that crossing an internal policy boundary gets recast as a crime.
Third-order effects
- If courts keep separating policy violations from unauthorized access, the CFAA's effective scope gets defined by successive judicial rulings rather than congressional amendment — leaving the statute narrowed but formally unchanged.
- The pattern pushes toward a two-tier legal regime where contract terms (ToS, employment policies) are enforced privately while the anti-hacking statute reserves its weight for genuinely unauthorized intrusion.
The trend: Courts are progressively stripping contract and policy breaches out of the Computer Fraud and Abuse Act, reserving the anti-hacking statute for actual unauthorized access.