## Facts

- Shurgard, a self-storage company, competed with Safeguard in the same market.
- Shurgard alleged Safeguard pursued a plan to recruit Shurgard employees to obtain Shurgard trade secrets and confidential business information.
- Shurgard alleged certain employees, while still employed by Shurgard, used Shurgard computers and email to transmit confidential information to Safeguard.
- Shurgard claimed that once those employees began acting as Safeguard’s agents, any further access to Shurgard’s computer systems was “without authorization” or “in excess of authorization” under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030.
- Shurgard alleged it suffered CFAA “damage” and “loss,” including harms associated with the misuse of its computer systems and response-related costs.
- Safeguard moved to dismiss only the CFAA count under Federal Rule of Civil Procedure 12(b)(6).

## Issues

1. Whether employees with valid access credentials can act “without authorization” or “in excess of authorization” under the CFAA when they access an employer’s computers for a competitor’s benefit while still employed.
2. Whether a competitor can face civil CFAA liability based on allegations it orchestrated or intentionally participated in employees’ unauthorized access.
3. Whether the complaint sufficiently alleged the CFAA’s required “damage” or “loss” to survive a Rule 12(b)(6) motion.

## Decision

- The court denied Safeguard’s Rule 12(b)(6) motion to dismiss the CFAA claim.
- The court held the complaint plausibly alleged that employees’ authorization ended when they began acting as Safeguard’s agents, making subsequent access “without authorization” or in excess of authorization.
- The court held the allegations were sufficient, at the pleading stage, to connect Safeguard to the asserted unauthorized access.
- The court held the complaint adequately alleged the CFAA’s damage/loss element to proceed past dismissal.

## Legal Principles

- On a Rule 12(b)(6) motion, the court accepts well-pleaded allegations as true and draws reasonable inferences in the plaintiff’s favor; conclusory allegations alone do not suffice.
- Under the CFAA, misuse of employer-granted computer access may qualify as access “without authorization” or “in excess of authorization” when employees allegedly repudiate their duty to act for the employer and instead act for a competitor.
- The CFAA is not limited, as a matter of pleading, to outside intrusions; insider misuse can fall within the statutory terms depending on the alleged scope of authorization.
- A third party may be subject to civil CFAA exposure where the complaint plausibly alleges intentional participation in, direction of, or conspiracy regarding unauthorized access.
- At the pleading stage, allegations of CFAA “loss” and related response costs may be sufficient to meet the civil-action threshold without detailed proof.

## Conclusion

The court allowed the CFAA claim to proceed, holding that allegations that employees used authorized credentials to access company systems for a competitor after becoming the competitor’s agents could constitute unauthorized access, that the competitor could be liable based on alleged intentional involvement, and that the pleaded damage/loss allegations were adequate under Rule 12(b)(6).


Shurgard Storage Ctrs., Inc. v. Safeguard Self Storage, Inc., 119 F. Supp. 2d 1121 (W.D. Wash. 2000)