## Facts

- International Airport Centers, L.L.C. and affiliated entities (IAC) employed Jacob Citrin to identify and assist with potential real estate acquisitions.
- IAC provided Citrin a company-owned laptop to record data he collected for his work.
- Citrin decided to quit and start a competing business, allegedly breaching his employment contract.
- Before returning the laptop, Citrin deleted files, including work data and data that would have revealed alleged improper conduct.
- Citrin did not merely delete files; he installed and used secure-erasure software that overwrote deleted files to prevent recovery.
- IAC alleged it had no copies of the erased files and suffered permanent data loss.
- IAC sued under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030(a)(5)(A)(i); the district court dismissed for failure to state a claim, and IAC appealed.

## Issues

1. Whether installing and running secure-erasure software constitutes “knowingly caus[ing] the transmission of a program, information, code, or command” under 18 U.S.C. § 1030(a)(5)(A)(i).
2. Whether Citrin acted “without authorization” under the CFAA when he destroyed data on his employer’s laptop after deciding to act contrary to IAC’s interests.

## Decision

- The Seventh Circuit reversed the Rule 12(b)(6) dismissal and remanded.
- The court held the complaint plausibly alleged a CFAA violation under § 1030(a)(5)(A)(i).
- The court concluded that loading and executing a secure-erasure program can satisfy the statute’s “transmission” element.
- The court held that, under agency-law principles, an employee’s authorization to access an employer’s computer ends when the employee breaches the duty of loyalty; thus, the alleged data destruction was “without authorization.”

## Legal Principles

- For § 1030(a)(5)(A)(i), causing a software program to be loaded and executed on a computer may qualify as causing the “transmission of a program, information, code, or command” when it results in intentional damage.
- “Damage” under the CFAA includes impairment to the integrity or availability of data; irreversible deletion of files can constitute statutory damage.
- In the employment context, authorization to access an employer’s computer may terminate when an employee resolves to act against the employer’s interests in breach of the duty of loyalty; subsequent access and destructive acts may be “without authorization.”

## Conclusion

The court held that an employee who installs and runs secure-erasure software to permanently destroy employer data can state a CFAA claim because the act can constitute a damaging “transmission,” and the employee’s authorization may be deemed terminated once he acts disloyally toward the employer.


Int'l Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418 (7th Cir. 2006)