Crimes That Harm Business (And Their Customers)
Businesses must deal with four major crimes: larceny, fraud, arson, and embezzlement.
Larceny is the trespassory taking of personal property with the intent to steal.
Fraud refers to a variety of crimes, all of which involve the deception of another person for the
purpose of obtaining money or property. Types of fraud include wire and mail fraud, insurance fraud,
Internet fraud, auctions, identity theft, and phishing.
Arson is the malicious use of fire or explosives to damage or destroy real estate or personal property.
Embezzlement is the fraudulent conversion of property already in the defendant’s possession.
Hacking is the gaining of unauthorized access to a computer system. Hacking is a crime under the
federal Computer Fraud and Abuse Act of 1986 (CFAA).1
Courts are now in the process of figuring out how to interpret the CFAA. In the following case, a
former employee clearly violated his company’s policies, but did he commit a crime? You be the judge.
You Be The Judge: United States v, Nosal2
Facts: David Nosal worked for an executive search firm, Korn/Ferry (K/F). Shortly after he left the
company to start a competing business, he convinced some of his former colleagues to log into the
company’s confidential database and give him customer names and contact information. K/F had
authorized the employees to access the database, but not to disclose confidential client information to
outsiders.
The government charged Nosal with aiding and abetting his former colleagues in violating a provision of
the CFAA that prohibits employees from exceeding their authorized access to a computer with intent to
defraud. The trial court granted Nosal’s motion to dismiss. The government appealed.
You Be the Judge: Did Nosal commit a crime when he aided and abetted others in violating a
workplace policy on computer use?
Argument for the Defendant: This provision of the CFAA can mean one of two things: (1) either it is
a crime to access unauthorized data or, (2) in a more expansive view, it can apply to anyone who is
legally entitled to access data, but who then uses this data in an unauthorized manner. That is what
happened here. The K/F employees were authorized to access the confidential database, but they were
not permitted to send it to Nosal.
Congress enacted the CFAA primarily to address the growing problem of computer hacking, i.e.,
“intentionally trespassing into someone else’s computer files.” But, under the government’s view,
everyone who
uses a computer in violation of company policy, which may well include
everyone who
uses a computer, would be a criminal.
According to the government, if an employer keeps certain
information
in a separate database that can be viewed on a computer screen, but not copied or
downloaded and an employee copies the information to a thumb drive, he could be charged with a
crime.
The computer gives employees new ways to procrastinate, by g-chatting with friends, playing games,
shopping or watching sports highlights. Such activities are routinely prohibited by many computer-use
policies. Under the broad interpretation of the CFAA, such minor violations would become federal
crimes. While it is unlikely that you will be prosecuted for watching cat videos on your work computer,
you could be. How will an employee know the difference between a minor personal use and a criminal
act?
Employees who call family members from their work phones will become criminals if they send an
email instead. They can read the sports section of USA Today at work, but they’d better not visit
1 18 U.S.C. Section 1030.
2 676 F.3d 854 United States Court of Appeals for the Ninth Circuit, 2012.