On April 10, 2012, the Ninth Circuit Court of Appeals held in United States v. Nosal, that employers may no longer rely on the Computer Fraud and Abuse Act (18 U.S.C. §1030) to threaten or bring federal criminal prosecution against employees who violate their computer use restrictions.

The Computer Fraud and Abuse Act (CFAA) punishes whoever:

"knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period." See, 18 U.S.C. §1030(a)(4)"

The CFAA defines "exceeds authorized access" as:

"to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." 18 U.S.C. § 1030(e)(6).

In Nosal, Nosal argued that the CFAA is essentially an anti-hacking statute and was not meant to apply to individuals who access a computer with authorization, but then misuse the information they obtained. The government, on the other hand, argued that the CFAA is not so limited and was meant to apply not only to hackers, but to anyone who "exceeds authorized access" and thereafter to anyone who misappropriates the information obtained. The difference is not as subtle as it seems. Under the government's argument, the CFAA has been used by employers in civil cases to argue that an employee violated §1030(a)(2)(C) by merely checking Facebook and sending personal email in violation of a company policy.

In Nosal, The Ninth Circuit Court of Appeals held that the CFAA should be read to only govern employee access to their employer's computer information, not the employee's use of their employer's computer information that the employee is otherwise entitled to access. In short, the CFAA applies to computer "hacking" violations ("restrictions on access"), not to incidental employee computer usage for non-work purposes (“restrictions on its use").

Employees and employers in California should proceed with caution, as there is a growing likelihood that eventually the U.S. Supreme Court will decide this issue since different circuit courts have come to different conclusions on the scope of the CFAA.