Shamrock Foods Company v. Jeff Gast and Sysco Food Services of Arizona, Inc.
535 F.Supp.2d 962
In the United States District Court for the District of Arizona
Case Number CV-0808-0219-PHX-ROS
Before District Judge R.O. Silver
Decided on February 20, 2008

Relevancy of the Case: Interpretation of “without authorisation” and “exceeds authorisation” under CFAA

Statutes and Provisions Involved

• The Computer Fraud and Abuse Act, 18 U.S.C. § 1030

Relevant Facts of the Case

• The plaintiff was the employer of the defendant. As an employee, he had signed a confidentiality agreement.
• This agreement prohibited him from using or disclosing any trade secrets, confidential information, knowledge or data relating to Shamrock.
• During his employment, he started negotiating with Sysco, a rival of the plaintiff company. Soon, he left the company and joined Sysco.
• The plaintiff performed a forensic analysis of his computer, which cost around $5000. This forensic investigation discovered that the defendant sent the plaintiff’s confidential and proprietary information to his personal email accounts.
• The plaintiff alleges that the first defendant has disclosed this information with Sysco, the second defendant. Now, the second defendant is exploiting this information to the detriment of Shamrock.
• The plaintiff has filed a complaint and motion for a temporary restraining order and brought claims under CFAA. The defendants moved to dismiss the claims under CFAA.

Prominent Arguments by the Counsels

• The defendant’s counsel submitted that he was not denying that he accessed a protected computer. However, as the plaintiff’s employee, he was authorised to access the company’s confidential and proprietary information.
• The plaintiff’s counsel contended that he could access the information as an employee. However, his authorisation ceased to exist when he acquired information for improper use, such as for his personal use, or to disclose it to Sysco, a rival business.

Opinion of the Bench

• A violation for accessing a protected computer without authorisation occurs only when initial access is not permitted. A exceeds authorisation violation occurs only when initial access is permitted, but access to other information is not.
• The first defendant had the necessary authorisation to view the files the plaintiff claims he emailed himself. The plaintiff fails to make a claim under CFAA.

Final Decision

• The District Court granted the defendant’s motion to dismiss the claim under CFAA.
• Further, the court closed the case and denied the plaintiff’s emergency motion for a temporary restraining order.

Anjini Pandey, an undergraduate student at Dr. Ram Manohar Lohiya National Law University, prepared this case summary during her internship with The Cyber Blog India in May/June 2022.