When a telecommunications company went defunct, almost literally on his way out the door, the former president and CEO of the company allegedly deleted certain e-mails from the company’s computers. When the company was placed in receivership, the receiver sued the former executive for a variety of his actions taken in connection with the collapse of the company. Among these claims was an assertion that when he deleted the e-mails, allegedly to cover up some misconduct, the executive violated the federal Computer Fraud and Abuse Act (CFAA).
One of the executive’s arguments was that the CFAA only makes it illegal to damage computers, and that the mere deletion of e-mails could not reasonably be regarded as inflicting such damage. The federal district court hearing the case disagreed. To require something like physical harm to a computer, or even some lesser injurious action of the kind, for there to be damage would be to ignore the expansive language that Congress used in drafting the CFAA.
“Damage” is defined in the law as “any impairment to the integrity or availability of data, a program, a system, or information.” Given that definition, the court concluded that even the commonplace act of deletion of data from the company computers impaired the availability of computerized data, thereby constituting damage within the meaning of the CFAA.
The executive was unable to have the case against him dismissed on this basis, but it remained for a jury to decide if he had, in fact, both deleted the e-mails and done so without authorization. On those points, an examination of the defendant’s e-mail box on the server was enough to allow a jury to find that he had deleted the e-mails in question.
The e-mail box had been reduced in size by about 98%. Moreover, even the previously authorized use of a computer system may become unauthorized when an employee breaches his duty of loyalty to his employer. The executive no doubt at some point had broad authority to deal with his company e-mails as he wished, but the pending litigation against him was replete with claims that he had been disloyal to the company in a number of different ways. If the receiver could prove such disloyalty, whatever authority the defendant had once had over the company computers was gone as quickly as he had left the premises following the deletions.