## Facts

- WEC provided welding and specialty services in the power-generation industry and competed with Arc in South Carolina.
- Willie “Mike” Miller worked for WEC as a Project Director and had employer-granted access to confidential business documents on WEC’s servers, including pricing, pending projects, and technical capabilities.
- WEC maintained computer-use and confidentiality policies limiting downloading and unauthorized use of confidential information.
- Before resigning (April 30, 2010), Miller allegedly downloaded WEC files to a personal computer and USB drive and sent documents to Emily Kelley’s personal email account.
- After resigning, Miller and Kelley presented to a potential customer on Arc’s behalf; WEC alleged the presentation relied substantially on WEC’s proprietary information and that the customer chose Arc over WEC.

## Issues

1. Whether an employee who is permitted to access an employer’s computer and data “accesses a computer without authorization” or “exceeds authorized access” under the CFAA by downloading and using that information contrary to employer policies or duties.
2. Whether violations of confidentiality agreements, computer-use policies, or duties of loyalty can supply the CFAA’s “without authorization” or “exceeds authorized access” element absent allegations of access to off-limits systems or files.

## Decision

- The Fourth Circuit affirmed dismissal of WEC’s CFAA claims under Rule 12(b)(6).
- The court held the CFAA is directed at improper access (hacking-type conduct), not the later misuse or misappropriation of information that was lawfully accessed.
- Because Miller and Kelley allegedly used valid credentials and were authorized to access the systems and information they obtained, the complaint alleged misuse, not unauthorized access.
- The court upheld the district court’s decision to decline supplemental jurisdiction over the remaining state-law claims.

## Legal Principles

- Under 18 U.S.C. § 1030(e)(6), “exceeds authorized access” concerns obtaining or altering information one is not entitled to obtain or alter by virtue of access limits, not violating downstream use restrictions.
- “Without authorization” and “exceeds authorized access” do not turn on an employee’s subjective intent or whether the employee breached fiduciary duties.
- Employer policies and private agreements restricting computer use or confidentiality do not, by themselves, convert authorized access into CFAA-prohibited access.
- Because the CFAA is primarily a criminal statute with a civil remedy, courts should construe it narrowly to avoid criminalizing ordinary policy violations; the rule of lenity supports an access-based reading.

## Conclusion

The Fourth Circuit limited CFAA liability to unauthorized access or access to prohibited data, holding that taking and using information an employee was allowed to view—despite policy, contractual, or loyalty breaches—does not satisfy the CFAA’s authorization elements, leaving such misconduct to other legal theories.


WEC Carolina Energy Sols. LLC v. Miller, 687 F.3d 199 (4th Cir. 2012)