top of page

New York Law Journal "Reviewing the CFAA: Second Circuit Clarifies Claim Accrual, Limitation&qu

Locks, the saying goes, keep honest people honest. Good physical security will keep out the

curious passer-by or casual miscreant, but no lock is perfect and the determined thief will

always find a way in. In recent years, it has become obvious that the same is true of the

Internet. As a practical matter, no connected computer system is impenetrable, and

password surveys routinely show that most people don't even have decent locks on their

doors. Yet individuals and businesses place vast amounts of crucial, sensitive information

online, assuming that it will remain secure. And when the locks fail, they turn to the law.

There are, of course, a number of legal protections against the misappropriation and misuse

of personal data, identity or intellectual property. They include federal and state statutes, as

well as common law claims of misappropriation, unfair competition and breach of duty, to

name a few. But the great majority of those protections focus on the information that's taken,

not the act of taking it. In the electronic universe, the damage from an intrusion often

includes not only the loss of data, but the costly disruption to the system itself. There is no

physical analog to that harm. A burglary victim is concerned about the assets in the safe, not

the damage to the safe itself. But online, the calculation may be different: The "safe" is often

a computer system or network that is vital to the victim's personal or business livelihood.

When dealing with computer intrusions, the law has to address that potential loss as well.

To address these unique concerns, Congress enacted the Computer Fraud and Abuse Act

(CFAA), which criminalizes the unauthorized access to certain kinds of computer systems

and also creates a private right of action to remedy damage caused by such access. But the

CFAA is a complex statute, and its language is not a model of clarity. Practitioners and

courts alike have consistently disagreed about the scope of conduct it addresses and the

accrual of actions arising out of that conduct. A recent Second Circuit decision clarifying the

latter issue offers an opportunity to examine the CFAA, its function and limitations, and its

utility as a tool for protecting electronic assets.

Recent Posts
Search By Tags
bottom of page