## Facts

- LVRC Holdings, LLC operated a residential treatment center in Nevada and used an outside vendor for email and website services.
- LVRC hired Christopher Brekka to oversee aspects of the facility, including internet marketing, and provided him computer access to perform his job.
- While employed, Brekka emailed LVRC documents to his personal email and to his wife, including financial and admissions-related reports.
- Some emails occurred during discussions about Brekka’s consulting businesses potentially acquiring an ownership interest in LVRC; negotiations later failed.
- After a dispute about time reporting and personal business at work, Brekka left LVRC in September 2003 and retained the documents he had emailed.
- After his departure, access logs showed that someone using Brekka’s login accessed and modified LVRC’s website from an IP address associated with Brekka’s home; Brekka denied doing so.
- LVRC sued under the Computer Fraud and Abuse Act (CFAA), alleging unauthorized access while Brekka was employed and after his employment ended; the district court granted summary judgment for defendants.

## Issues

1. Whether an employee who is permitted to use an employer’s computer violates the CFAA by emailing employer documents to himself and his wife during employment under the “without authorization” or “exceeds authorized access” provisions.
2. Whether the employer produced sufficient evidence to create a genuine dispute that the former employee accessed the employer’s website “without authorization” after employment ended.

## Decision

- The Ninth Circuit affirmed summary judgment for defendants on the CFAA claims.
- Brekka did not access LVRC’s computers “without authorization” when he emailed documents to himself and his wife while still employed because LVRC had granted him permission to use the computer system.
- Brekka did not “exceed authorized access” because he was entitled, as part of his job, to obtain the documents he emailed.
- LVRC failed to present sufficient evidence that Brekka himself accessed LVRC’s website after leaving; the presence of his login name and an IP address linked to his home did not create a triable issue on identity.

## Legal Principles

- Under the CFAA, access is “without authorization” when a person lacks permission to access the computer at all, or when permission has been rescinded and the person accesses the computer anyway.
- “Exceeds authorized access” requires that the user, though authorized to access the computer, obtains or alters information the user is not entitled to obtain or alter.
- An employee’s improper purpose, alleged disloyalty, or later misuse of information does not convert otherwise permitted access into CFAA “unauthorized” access absent revocation or limits on entitlement to the accessed information.
- On summary judgment for alleged post-termination access, evidence must support a reasonable inference that the defendant, not an unknown third party using credentials, performed the access.

## Conclusion

The court held that the CFAA focuses on permission-based access, not motive: an employee with granted access does not violate the statute by emailing information he was allowed to obtain, and claims of post-employment unauthorized access require evidence linking the defendant to the access beyond logs showing use of his credentials.


LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009)