Ex-Worker’s Google Drive Access May Breach Computer Fraud Law

By Alexis Kramer

A former transportation logistics company employee may have run afoul of a federal computer fraud law when he accessed a Google Drive account he had created for his employer, the U.S. District Court for the Eastern District of Virginia held March 9 ( Estes Forwarding Worldwide LLC v. Cuellar , 2017 BL 74693, E.D. Va., No. 3:16-CV-853-HEH, 3/9/17 ).

The scope of the law, the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, has been widely debated, particularly because it was originally designed to criminalize computer hacking. The U.S. Court of Appeals for the Ninth Circuit last year shed some light on what constitutes unauthorized access under the law, which was enacted in 1986. But the Virginia case adds a new layer to the uncertainty surrounding that critical element.

Plaintiff Estes Forwarding Worldwide LLC alleged that former employee Marcelo Cuellar created the account “on behalf of EFW” so that employees could record shipment and vendor information. EFW alleged that after Cuellar left the company he accessed the account, downloaded the information onto a computer at his new job and then deleted the account.

Judge Henry E. Hudson rejected Cuellar’s motion to dismiss the case. Cuellar contended that because he created the account, Google’s authorization—not EFW’s—matters for purposes of determining whether the law was broken.

“Cuellar’s principal argument conspicuously ignores the fact that he only did so while acting in the course and scope of his employment and for the benefit of EFW, not for personal use,” the court said.

The court distinguished the case from Hoofnagle v. Smyth-Wythe Airport Comm’n, W.D. Va., No. 1:15-cv-00008-JPJ-PMS, 2016 BL 164647, 5/24/16 , in which another federal district court in Virginia held a former airport worker could pursue a claim that his employer allegedly accessed his Yahoo! Inc. e-mail account without authorization. The Hoofnagle court said that although the plaintiff created the account in part to conduct airport business, he did so with his personal information and also used the account for personal reasons.

The EFW court said that unlike Hoofnagle, Cuellar didn’t create the Google Drive account as a personal account. At “no point in the complaint does EFW allege that Cuellar—or any other employee, for that matter—utilized the account for personal use like the Plaintiff in Hoofnagle,” the court said.

LeClair Ryan PC represented EFW. K&G Law Group PLLC represented Cuellar.

To contact the reporter on this story: Alexis Kramer in Washington at aKramer@bna.com

To contact the editor responsible for this story: Keith Perine at kperine@bna.com

For More Information

Full text at http://src.bna.com/mR7.

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.