The Sales Manager, Conversion and the Computer Fraud and Abuse Act

This post examines an opinion the Arkansas Court of Appeals recently issued in a civil case:  Infinity Headwear & Apparel, LLC v. Coughlin, 2014 Ark. App. 609 (2014).  The judge who wrote the opinion began by outlining how the case arose and what it involved:

Infinity markets sportswear, apparel, and other products. In May 2008, Coughlin was hired as Infinity's sales manager. Coughlin signed an acknowledgment of company policies informing him that all work product was the sole property of Infinity and was nontransferable. Coughlin did not sign a nondisclosure provision or a non-compete agreement.

In August 2012, Coughlin began working for Outdoor Cap Co., Inc., a larger competitor of Infinity. Before leaving Infinity, Coughlin emailed files from Infinity's database to his personal email account. This database contained, among other things, Infinity's sales plans, margins, marketing and operating costs, customer and supplier lists, royalty negotiations, and future project ideas. Only employees could access the database. In September 2012, 

Infinity sued Coughlin for breach of contract, violating the Theft of Trade Secrets Act, breaching a duty of loyalty, and conversion. Infinity also sought temporary injunctive relief against Coughlin. Coughlin responded to Infinity's motion for a temporary restraining order.

Following an evidentiary hearing, the circuit court denied Infinity's motion for a temporary restraining order because Infinity had not adequately protected its information as the trade-secrets law requires. . . .

Infinity Headwear & Apparel, LLC v. Coughlin, supra.

After the judge denied the temporary restraining order, Infinity amended its complaint.

The first amended complaint dropped the trade-secrets claim but raised six claims: that Coughlin (1) breached a contract, (2) violated the federal Computer Fraud and Abuse Act (CFAA), (3) committed unlawful acts under an Arkansas statute dealing with computer-related activity (Arkansas Code § 5–41–202), (4) breached a duty of loyalty, (5) converted tangible and intangible property, and (6) was liable for replevin. Infinity sought, among other things, damages, injunctive relief, and an order directing that Coughlin to return all of Infinity's property. Coughlin answered the complaint.

Infinity Headwear & Apparel, LLC v. Coughlin, supra.

At some point after Coughlin filed his answer to Infinity’s amended complaint, he filed a motion for summary judgment.  Infinity Headwear & Apparel, LLC v. Coughlin, supra.  As Wikipedia explains, in U.S. civil litigation, a court can award summary judgment, which often means there will be no trial.  And as Wikipedia also explains, a court can only grant summary judgment if the judge finds that “1. there are no disputes of `material fact

requiring a trial to resolve, and 2. in applying the law to the undisputed facts, one party is clearly entitled to judgment.”  Infinity Headwear & Apparel, LLC v. Coughlin, supra.

The trial judge held a hearing on Coughlin’s motion, and eventually granted it.  Infinity Headwear & Apparel, LLC v. Coughlin, supra.  The judge held that

any contract between the parties was oral and that, in any event, there was no triable issue on whether a breach had occurred. On the breach-of-loyalty claim, the court ruled there was no such claim because no fiduciary relationship existed between the parties; nor was one ever alleged. The court also found that Coughlin was permitted to copy data to a personal computer so that he could work remotely.

The court also ruled that there was no genuine issue of material fact in dispute on the point that Coughlin deliberately destroyed or misused data and thus rejected the federal CFAA claim. Regarding the state-law computer claim, the court entered judgment for Coughlin because the statute unambiguously stated that there was no civil remedy available for alleged unlawful acts regarding a computer. The court entered summary judgment on the conversion claim because, according to it, our supreme court has not recognized a cause of action for conversion of intangible things like Infinity's data and, in any event, Coughlin did not deprive Infinity of the data or its use.

Infinity Headwear & Apparel, LLC v. Coughlin, supra. 

Infinity appealed the decision, but abandoned some its claims on appeal.  Infinity Headwear & Apparel, LLC v. Coughlin, supra.  On appeal, it argued that the trial judge erred when he “(1) granted Coughlin's motion on the conversion claim, (2) held that no claim exists for breach of the duty of loyalty, and (3) found that, to assert a claim under CFAA, a misuse or destruction of data is required.” Infinity Headwear & Apparel, LLC v. Coughlin, supra.

The Court of Appeals began its analysis of the arguments on appeal by explaining that

summary judgment is proper only when there are no genuine issues of material fact to be litigated, and the party is entitled to judgment as a matter of law. Locke v. Cont'l Cas. Co., 2013 Ark. App. 690 (Arkansas Court of Appeals 2013). Once the moving party has established a prima facie entitlement to summary judgment, the opposing party must meet proof with proof and show the existence of a material issue of fact. Locke v. Cont'l Cas. Co., supra. We determine if summary judgment was appropriate based on whether the evidentiary items presented by the moving party leave a material fact unanswered, focusing our review not only on the pleadings, but also on the affidavits and documents filed. Locke v. Cont'l Cas. Co., supra. We view the evidence in the light most favorable to the party against whom the motion was filed, and resolve all doubts and inferences against the moving party. Locke v. Cont'l Cas. Co., supra.

Infinity Headwear & Apparel, LLC v. Coughlin, supra.

Since Infinity did not appeal the trial judge’s granting summary judgment for Coughlin on the breach of contract, replevin and Arkansas Code § 5–41–202 claims, the Court of Appeals did not address them.  Infinity Headwear & Apparel, LLC v. Coughlin, supra.  It only addressed the three issues on which the trial judge granted summary judgment, beginning with the breach of loyalty claim:

Infinity argues that the circuit court erred in ruling that Arkansas does not recognize a claim for breaching the duty of loyalty. Infinity correctly observes that no Arkansas appellate court has addressed whether a company like it may pursue an independent, freestanding breach-of-loyalty claim in the circumstances this case presents. We hold that the circuit court was correct: Arkansas law does not recognize an independent breach-of-loyalty claim on this case's facts, and we decline to recognize one at this time.

Infinity Headwear & Apparel, LLC v. Coughlin, supra. 

The Court of Appeals then took up the trial judge’s granting Coughlin summary judgment on the federal Computer Fraud and Abuse Act claim, which arose under 18 U.S. Code § 1030.  Infinity Headwear & Apparel, LLC v. Coughlin, supra.  It found that the

summary judgment against Infinity's claim that Coughlin violated the Computer Fraud and Abuse Act . . . was also justifiable. The circuit court ruled there was no evidence that Coughlin had deliberately destroyed or misused Infinity's data. Our analysis differs somewhat from the circuit court's -- it arguably took a failure-of-proof approach while we take more of a statutory-interpretation approach -- but the end result is the same.

Infinity Headwear & Apparel, LLC v. Coughlin, supra. 

The Court of Appeals went on to explain that “some” federal courts have said that

The CFAA's general purpose was to protect the public against computer hackers (so-called electronic trespassers). Dresser–Rand Co. v. Jones, 957 F.Supp.2d 610 (U.S. District Court for the Eastern District of Pennsylvania 2013); accord Shamrock Foods Co. v. Gast, 535 F.Supp.2d 962 (U.S.District Court for the District of Arizona 2008); U.S. Bioservices Corp. v. Lugo, 595 F.Supp.2d 1189 (U.S. District Court for the District of Kansas 2009).

Generally speaking, the legislation permits a person who `suffers damage or loss’ because of a violation of the CFAA to `maintain a civil action against the violator’ for damages and injunctive relief. 18 U.S. Code § 1030(g). The act defines `damage’ as `any impairment to the integrity or availability of data, a system, or information.’ 18 U.S. Code § 1030(e)(8). `Loss’ under the CFAA is defined broadly as `any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.’ 18 U.S. Code § 1030(e)(11). The loss suffered from a violation must exceed $5,000 before a civil suit may be filed. 18 U.S. Code § 1030(c)(4)(A)(i)(I).

Infinity Headwear & Apparel, LLC v. Coughlin, supra. 

The court then outlined Infinity’s argument and the general CFAA standards relating to the “authorized” use of a computer:

Infinity argues that triable issues of fact exist regarding Coughlin's authorization to access its computers. Specifically, it says that `the parties dispute material facts as to whether Coughlin was authorized to use the computers of Infinity to send files to his personal email account in preparation to join a competitor,’ and `[t]hey further dispute whether he was authorized to keep these files after leaving Infinity's employ.’ We disagree that genuine issues of disputed material fact exist to prevent summary judgment on this record and CFAA's provisions.

Under CFAA, `an employee is authorized to access a computer when his employer approves or sanctions his admission to that computer,’ an employee is `without authorization’ when `he gains admission to a computer without approval,’ and an employee an `exceeds authorized access’ `when he has approval to access a computer, but uses his access to obtain or alter information that falls outside the bounds of his approved access.’ WEC Carolina Energy Solutions LLC v. Miller, 687 F.3d 199, 204 (U.S. Court of Appeals for the 4th Circuit 2012).

Infinity Headwear & Apparel, LLC v. Coughlin, supra. 

The Court of Appeals then found that there was no “genuine dispute”

of material fact on whether Coughlin accessed a computer without authorization or exceeded his authorized access so as to trigger CFAA's provisions. Infinity allowed its employees, like Coughlin, to use computers to access company information of the sort at issue in this case. Infinity's CFO testified that fourteen people had access to the same information, termed `shared resources,’ that Coughlin did when he left Infinity.

Using a unique password, each Infinity employee could access all of Infinity's shared data. The CFO further stated that `[i]t is possible that any or all employees have the very same documents on their personal computers as Michael Coughlin did.’ Simply put, because Infinity allowed or permitted Coughlin to access and download Infinity's shared data, he cannot be liable under the CFAA. See WEC Carolina Energy Solutions, LLC v. Miller, 687 F.3d 199 (U.S. Court of Appeals for the 4^th Circuit 2012). . . .

That he emailed this information to a personal email account is not a material legal point. `Whatever happens to the data subsequent to being taken from the computers . . . is not encompassed in the purview of the CFAA.’ Dresser–Rand Co. v. Jones, supra. Another court has put the matter this way in a similar factual context: `Because [the employee] was authorized to use [the company's] computers while he was employed at [the company], he did not access a computer ‘without authorization’ in violation of § [18 U.S. Code] 1030(a)(2) or § 1030(a)(4) when he emailed documents to himself and to his wife prior to leaving [the company]. Nor did emailing the documents `exceed authorized access,’ because [the employee] was entitled to obtain the documents.’  LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (U.S. Court of Appeals for the 9^th Circuit 2009).  

Given this case's facts, we hold that the circuit court did not err in granting summary judgment against Infinity's CFAA claim.

Infinity Headwear & Apparel, LLC v. Coughlin, supra. 

Finally, the Court of Appeals took up the trial judge’s granting summary judgment for Coughlin on the conversion claim, noting that the Arkansas Supreme Court has held

that the Theft of Trade Secrets Act preempts tort claims for conversion of trade secrets. R.K. Enter., LLC v. Pro–Comp Mgmt., Inc., 356 Ark. 565, 158 S.W.3d 685 (2004). The court made clear that the Trade Secrets Act is the exclusive remedy for the alleged misappropriation of trade secrets. In our view, this fact answers Infinity's electronic-data conversion claim. To the extent it asks us to create a new cause of action for the conversion of electronic data, we decline to do so. The circuit court's decision to reject Infinity's conversion claim as it relates to electronic data is affirmed.

Infinity Headwear & Apparel, LLC v. Coughlin, supra. 

It went on to explain that this case was

mostly about intangible information or business data that Infinity said Coughlin took and used to unfairly disadvantage Infinity in the marketplace. But there is a `tangible property’ argument too.

On the collateral argument that some tangible property was unlawfully taken from Infinity, the circuit court's order more or less granted it the relief it sought: the court found Coughlin did not possess `the information and property . . . described in [Infinity's] First Amended Complaint. Any such information and property that is currently in the possession of [Coughlin's] counsel shall be returned to [Infinity's] counsel subsequent to the entry of this Order.’ That order resolved any tangible-property dispute given the case's history.

For example, during the temporary hearing in October 2012 that addressed the then-pending trade-secrets claim, it appears that the tangible-property angle, to the extent one existed, was `worked out between the lawyers.’ And during the hearing on the motion for summary judgment in July 2013, Infinity's lawyer stated that `[t]he claim for replevin need not go forward assuming the Taylor Law Firm is keeping the information appropriately.’ Finally, Infinity's brief points us to Doug Keller's affidavit as it argues its conversion claim on appeal, but that affidavit does not clearly delineate what property was wrongfully taken and needed to be returned. The bottom line is that no triable issue exists on the conversion claim.

Infinity Headwear & Apparel, LLC v. Coughlin, supra. 

The Court of Appeals therefore affirmed the trial judge’s grant of summary judgment. Infinity Headwear & Apparel, LLC v. Coughlin, supra.