Recently in Privacy In the Workplace Category

Can An Employer Sue an Employee for On-Duty Facebook Use?

Posted by Molly DiBiancaOn May 24, 2011In: Privacy In the Workplace

Email This Post | Print this Post

Probably not successfully.  But that didn't stop one employer from trying. In Lee v. PMSI, Inc., the plaintiff sued her former employer for pregnancy discrimination. The employer filed a counterclaim under the Computer Fraud and Abuse Act (CFAA).  The basis for the claim was that Lee engaged in "excessive internet usage" and "visit[ed] personal websites such as Facebook and monitor[ed] and [sent] personal email through her Verizon web mail account."  That's right--the employer sued its former employee on the basis that the employee's on-duty Facebook use constituted a violation of the CFAA. FB Logo

As you may imagine, the federal district court did not find merit in this claim.  U.S. District Judge Steven D. Merryday, of the Middle District of Florida, Tampa Division, granted the employee's motion to dismiss, finding that the employer had failed to allege either of the two bases for a CFAA violation--that the employee caused damages to the computer system or that the employee obtained information to which she was not entitled.

Additionally, the employer failed to allege that the employee "exceeded authorized access."  This prong has been the sticking point for those courts that are split as to whether the CFAA--a statute intended for use in the prosecution of computer hackers--should be applied in the employment context.  Although there is a split of authority on when it is that a disloyal employee loses her authorization to access the employer's computer network, these facts seem to go beyond any reasonable interpretation of the statute. 

I suppose we could give the employer some credit for its attempted "novel" application of the CFAA.  But I think more credit should be allocated to the court for rightly applying what can be a complicated law. 

Thanks to Michael R. Greco at Fisher & Phillips, LLP's Non-Compete and Trade Secrets Blog, whose post alerted me to the case.

See also:

 

9th Circuit Applies CFAA to Disloyal Employee

Putting the Computer Fraud Abuse Act to Work for Employers

9th Circuit Applies CFAA to Disloyal Employee

Posted by Molly DiBiancaOn May 9, 2011In: Privacy In the Workplace

Email This Post | Print this Post

Employee theft of documents is a serious issue today. More and more often, employers discover that, before exiting, a former employee took with him (often by forwarding himself via email), many of the company’s confidential documents. The employer has limited ways to respond. If the employee refuses to comply with the employer’s demand to return the documents, it may be necessary to file suit.keyboard alert

One of the claims that an employer may bring is under the federal Computer Fraud and Abuse Act (CFAA). The CFAA is also a criminal statute, originally designed to target computer hackers—not disloyal employees. And some jurisdictions have rejected claims seeking to apply the CFAA to the employment context. The leading case finding that the CFAA can be applied to the disloyal employee is International Airport Centers, LLC v. Citrin, which was decided by the Seventh Circuit in 2006. The key to the Citrin decision and others like it is a determination that, although the employee may have been “authorized” to access the employer’s files initially, that authorization is automatically revoked once the employee becomes disloyal. Any access after this point is, by definition, “in excess” of the authorization previously provided.

Three years later, in 2009, the Ninth Circuit rejected the Seventh Circuit’s Citrin analysis, finding, instead, that an employee’s authorization to access his employer’s computer network is not revoked automatically when the employee becomes disloyal to his employer. [1] The Brekka decision held that accessing and emailing the employer’s files for a purpose contrary to the employer’s interests, alone, did not violate the CFAA.

In April, the Ninth Circuit decided United States v. Nosal (PDF), which substantially limits the Brekka decision. In Nosal, the court held that, where an employer has placed limits on the employee’s “permission to use” the computer and the employee exceeds those limits, the CFAA has been violated. The court distinguished this from Brekka, in which the employee’s access was unlimited, whereas, in Nosal, there was an employee agreement warning employees that violation of the company’s computer-usage policy could lead to disciplinary action or criminal prosecution.

In Nosal, the defendant-employee worked for an executive-search firm. When he left, he executed a one-year non-compete agreement. Shortly thereafter, he decided to start a competing business and enlisted some of his former coworkers to use their accounts to access confidential information for him from the company’s computer network. The employees were authorized to access the data—but only on behalf of their employer and only for legitimate business purposes. Thus, when the employees transmitted the data to Nosal, they were acting beyond the scope of their authorization.

Although this decision is an important victory for employers, it does have its limits. For a violation of the CFAA to occur, according to the court’s opinion in Nosal, the employer must have placed restrictions on the employee’s use. A well-drafted permissible-use policy is likely a necessary element of a successful CFAA claim in the Ninth Circuit, as evidence of steps taken by the employer to protect its data and files.

[1] LVRC Holdings, LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009).

See also, our previous posts:

Employer Liability for Accessing Employee’s E-Mails

Posted by Molly DiBiancaOn March 2, 2011In: Electronic Monitoring, Privacy In the Workplace

Email This Post | Print this Post

When a former employee sues his former employer, an immediate issue of concern is how to preserve all electronically stored information (ESI) that may be relevant to the claim. Failure to do so may result in a claim of spoliation, sanctions against the employer and its legal counsel, or even an adverse ruling. Good employment counsel understands these consequences and how to avoid them in the first instance.

One of the most common steps is to have the employee’s computer forensically imaged by an expert. The expert will also preserve the employee’s company e-mail account. But this does not address the possibility that the employee may have sent e-mails from his work computer via a web-based e-mail service, such as Yahoo or G-mail. The law is not clear on this point and the defensibility of this practice can vary depending on the content of the e-mails—which, of course, the employer will not know until it looks.

There are several laws that employers risk violating by accessing an employee’s “personal” or web-based e-mail account. The federal Stored Communications Act is one such law and is the one that seems to result in more liability than others. A decision from late last year provides a recent example.

In Pure Power Boot Camp, Inc. v. Warrior Fitness Boot Camp, LLC, two employees prepared to open a competing fitness center with their then-employer. One of the employees quit and the other was fired. After the second employee was terminated, the employer accessed and printed emails from his web-based e-mail accounts. Although it was a disputed issue, the employer claimed that the employee had saved his username and password to the employer’s computer system.

The employer filed suit in New York state court to enforce a non-compete agreement and prevent the employees from opening their competing business. The court denied the request for an injunction and the employees removed the case to federal court, where they brought a counter-claim against the employer based on the allegedly improper access of the e-mails. At the request of the employees, the court ordered the employer to return all e-mails and prohibited their use in the case.

The court’s decision was based on its finding that the employer’s access of the employee’s emails violated the Stored Communications Act (SCA), which prohibits unauthorized access of e-mail correspondence that has been saved or stored once sent (among other things). The employees were awarded damages in the relatively small amount of $4,000 but I’m sure this felt like anything but a victory for the employer. The employer contended that it had done nothing wrong even if it had accessed the e-mails—they were, after all, stored on the employer’s computers, along with the username and password to access them. Worse yet, the e-mails supported the employer’s claim that the employees had been preparing to compete during their employment and had gone on to open a competing business.

The lesson from this case and the others like it is to be extremely cautious when deciding whether you may lawfully access an employee’s personal e-mails. Additionally, employers should revisit their computer-usage policies to make sure that the language is crystal clear that employees should not expect that their use of company computers will be considered private—including all Internet activity and, specifically, web-based e-mail accounts to the extent they are accessed via the employer’s computer.

Pure Power Boot Camp, Inc. v. Warrior Fitness Boot Camp, LLC, No. No. 08 Civ. 4810 (THK) (S.D.N.Y. Dec. 22, 2010).

[Thanks to Venkat and his post on the Technology and Marketing Law Blog for bringing this case to my attention.]

Putting the Computer Fraud and Abuse Act to Work for Employers

Posted by Molly DiBiancaOn February 4, 2011In: Privacy In the Workplace

Email This Post | Print this Post

Consider this scenario:  Your Human Resources Manager decides to leave your employ but, before she announces her decision, she copies all of the company’s policies, forms, and even confidential salary data.  She emails herself copies of these files and saves them on a flash drive, which she takes with her when she leaves on the last day. You discover the theft after she’s left and are horrified.  What recourse do you have?  modern computer, monitor, cpu

Part of the answer will depend on your jurisdiction.  In certain jurisdictions, employers may be able to use a law called the Computer Fraud and Abuse Act (CFAA) to fight back against disloyal employees.  The CFAA prohibits “intentionally access[ing] a computer without authorization or exceed[ing] authorized access” in certain circumstances.  A recent decision by the Eleventh Circuit Court of Appeals is an important one for employers not only in the states within the 11th Circuit but also for employers in states, like Delaware, where their circuit court of appeals (in our case, the Third Circuit), has not yet ruled on the application of the CFAA to the employment-law context.

Roberto Rodriguez worked for the Social Security Administration (SSA) and had access to the SSA’s databases as part of his job duties. The SSA’s policy prohibits its employees from using the databases for non-business reason. Rodriguez violated this policy when he looked up personal information about various women that he knew and had met. He looked up his ex-wife’s earnings history and the address of a woman he met at a church study group to send her flowers on Valentine’s Day.  Rodriguez was found guilty on 17 counts of violating the CFAA.

On appeal, Rodriguez argued that he did not violate the CFAA because, at all times, he had been authorized to access the databases.  Thus, he argued, he could not be guilty of “intentionally accessing a computer without authorization.”  Although this argument may have worked, he could not avoid the second theory available under the CFAA—that he had “exceeded authorized access.”  The CFAA defines this as “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled to obtain or alter.”

The 11th Circuit upheld the conviction under the second prong, finding that Rodriguez exceeded his authorized access and violated the CFAA when he obtained personal information for a nonbusiness reason. In other words, the court concluded that, although Rodriguez had authority to access the database at the time he looked up the women’s personal information, he exceeded that authorization when he violated his employer’s policy and accessed the database for reasons beyond the scope of the authority he’d been given.

This is an important decision for employers because it approves an interpretation of the CFAA whereby employees who misuse their access to their employer’s computer network constitutes a violation of the law.

United States v. Rodriguez, No. 08-16696 (11th Cir. Dec. 27, 2010)

See also Computer Fraud and Abuse Act: Government to the Rescue of Employers?

Putting the CFAA to Use, TV Style

Work Email and the Attorney-Client Privilege Do Not Mix

Posted by Lauren E. MoakOn January 23, 2011In: Electronic Monitoring, Privacy In the Workplace, Privacy Rights of Employees

Email This Post | Print this Post

An appeals court in California recently decided that emails sent by an employee from her work email address to her attorney are not protected by the attorney-client privilege. In the case of Holmes v. Petrovich Development Company, LLC, an employee sued her employer for wrongful termination. Prior to filing her lawsuit, she had exchanged emails with her attorney, using her office email account. The employer used the emails in its defense, and the employee objected, claiming that they were protected by attorney-client privilege.

The Court disagreed and found that the emails were not protected by the privilege.  The court relied on the fact that the employer’s handbook expressly stated that an employee’s emails might be monitored. Such a warning, the Court concluded, made the employee’s emails akin a conversation held in the company’s conference room, with the door open, speaking in a loud voice. The California Court’s decision is in keeping with the Supreme Court’s 2010 decision in City of Ontario v. Quon, in which the Court held that an employee did not have an expectation of privacy in his text messages, sent using an employer-provided pager. This case, however, takes Quon to its logical conclusion, holding that in the absence of a reasonable expectation of privacy, the attorney-client privilege cannot attach.

As Delaware employers should know, they are required by statute to inform employees prior to monitoring an employee’s telephone, email, or internet use. 19 Del. C. § 705. Thus, under the California Court’s logic, any Delaware employee who has received notice of email monitoring under Delaware law has waived the attorney-client privilege as to any emails exchanged with the employee’s attorney, using his or her work email account. It is important to remember that the Delaware courts have not ruled on the issue of attorney-client privilege for work emails. However, this case is a valuable reminder that electronic communications are rarely as private as they appear, and we should all conduct ourselves accordingly.

Delaware Events to Fight Identity Theft

Posted by Molly DiBiancaOn October 6, 2010In: Privacy In the Workplace, Privacy Rights of Employees

Email This Post | Print this Post

Delaware readers may be interested a few upcoming events designed to help prevent identity theft. Delaware’s Identity Theft Working Group is sponsoring these events during the week of October 18-24, which is National Protect Your Identity Week.

Oct. 20:  Senior Identity Theft & Fraud

This educational event will take place from 10:30 a.m. – 12:30 p.m. at the Modern Maturity Center in Dover, located at 1121 Forrest Avenue.  You can RSVP for this event and get more information by calling 302-734-1200.

Oct. 21:  Protecting Small Business from Identity Theft

This event is sponsored by the Better Business Bureau of Delaware and will be held at the Wilmington Double Tree Hotel, located at 700 N. King Street from 7:45 a.m. till 10 a.m.  RSVP for the event by calling 302-230-0112 ext. 19.

Oct. 22:  Working Together to Combat Identity Theft

The Federal Bar Association is co-sponsoring a Law Enforcement and Financial Institution training titled “Working Together to Combat Identity Theft” on October 22, 2010, from 8:00 a.m. to 12:30 p.m. at Theatre N, First Floor, 1007 Orange Street, Wilmington, DE 19801.  The October 22 training will include the following discussion topics:

  • Elements of Proof of Identity Theft Crimes:  A Federal and State Overview
  • An Identity Theft Investigation Case Study:  What Worked and Why
  • Addressing Expectations of Both Financial Institutions and Law Enforcement In Investigating Identity Theft Cases
  • Panel Discussion:   Financial Institution Investigators and Federal and State Investigators

In order to register for this training, which will be of primary interest to prosecutors and those lawyers who work with clients to investigate matters relating to identity theft, submit this registration form by October 18, 2010.  If you RSVP for the training, please indicate that you are an attorney who will wish to seek Delaware CLE credit for the training.  The training is free.

Oct. 23:  Shred Event

Consumers may bring up to 3 file-size boxes of documents for shredding to the Boscov’s at the Dover Mall between 9 a.m. and 1 p.m.  The Delaware Attorney General is the sponsor of this event and more information can be found at www.attorneygeneral.delaware.gov.

You can print the following poster, which includes information about all of these events. 

Identity Theft Event Poster

Employers in any state can celebrate National Protect Your Identity Week by educating employees about how to protect themselves from identity theft.

It's Unanimous: Supreme Court Permits Search of Employees' Electronic Communications

Posted by Molly DiBiancaOn June 18, 2010In: Privacy In the Workplace

Email This Post | Print this Post

In Quon v. City of Ontario, the 9th Circuit held that a California police department’s review of an officer’s text messages was an invasion of the officer’s right to privacy. In a unanimous ruling issued yesterday, the U.S. Supreme Court overturned the Quon decision and ruled that the police department’s review of the provocative text messages sent by the officer to his wife and to his mistress from his employer-issued pager, did not constitute an invasion of the officer’s privacy. (Link to the full opinion in City of Ontario v. Quon).

For employers, the key component of the decision is the Court’s focus on the fact that the police department-employer’s review of the messages comported with its policy and was conducted for a legitimate business reason. The department’s policy provided that messages would not be reviewed unless the employee went over the allotted monthly usage. In Quon, the officer had exceeded the monthly limit and the department reviewed the messages to determine whether the overages were work-related. Officers were responsible for costs incurred for non-work-related messages if they went over the monthly limit.

The 9th Circuit ruled that this review constituted an unreasonable search and seizure in violation of the Fourth Amendment. That decision was based largely on the fact that the officer’s supervisor had told the officer that messages were never reviewed by the department. The federal appellate court found that, because he’d been permitted to use the pager for both personal and work-related use, the officer had a reasonable expectation of privacy in those communications.

This important decision is the Supreme Court’s first in the area of an employer’s right to monitor the electronic communications of its employees sent and received during working time or with work-issued devices.

The decision was not a free-for-all pass for employers who want to review employees' electronic messages. The Supreme Court warned employers of the possibility that an expectation of privacy may exist in certain circumstances. Interestingly, the Court noted that the expectation of privacy may exist due to to the pervasiveness of electronic communications. Justice Kennedy, writing for the Court, explained that “cellphone and text message communications are so pervasive that some persons may consider them to be essential means or necessary instruments for self-expression, even self-identification.”

But the Court also recognized that the pervasiveness of cellphones and other electronic-communication devices, has also driven down the cost of such devices, making them “generally affordable.” The low cost of electronic-communication devices, the Court found, supports the argument that there is a very low or no expectation of privacy because an employee who needs a cellphone for personal use can buy one and avoid having to use the work-issued device for anything other than work-related communications.

The decision is a critical one for employers who want to ensure employee compliance with company rules and policies without violating the employee’s privacy rights and, in turn, exposing the organization to legal liability. The Quon opinion has two key components for employers:

1. Any workplace monitoring must comply with the employer’s policy—if you don’t have a clear policy, now is the time to get one; and

2. A search of electronic communications should not go beyond what is necessary to accomplish the legitimate business purpose behind the policy—use the least intrusive means possible to make the determination at issue.

I Always Feel Like, the School Is Watching Me: Electronic Monitoring Gone Wrong?

Posted by Michael P. StaffordOn February 18, 2010In: Privacy In the Workplace

Email This Post | Print this Post

Electronic monitoring is a very hot topic in employment law these days. But what about other types of electronic monitoring by employers?  A case filed in the U.S. District Court for the Eastern District of Pennsylvania alleges a much more unusual sort of electronic monitoring.  The suit alleges that Lower Marion School District distributed over 1,800 laptops to its students.  So far, so good.3d binoculars

But, according to the Complaint (via Above the Law), the laptops were equipped with webcams. 

How could this not end badly?

The suit alleges that school administrators remotely activated the webcams.  One is alleged to have gone so far as to discipline a student for “improper behavior in his home."  Funny, I've never seen that one in a student code of conduct. It is also alleged that the District was also tracking all the students' online activity. 

Employers commonly provide employees with laptops for business-related use.  If your organization is one such employer, maybe consider skipping the upgrade to the models with webcams.

When Did Working at Work Become Optional?

Posted by Molly DiBiancaOn December 31, 2009In: Privacy In the Workplace, Social Media in the Workplace

Email This Post | Print this Post

The line between work and home is hardly visible.  To describe it as “blurred” would be inaccurate. The reality (for most of us) is that the line can barely be seen and, for some, only fades into existence occasionally for short intervals.   And there seems to be little debate about the validity of this conclusion.  The debate begins only when the question is asked whether this reality is a positive or negative one.


For most, I believe it’s perceived negatively. At least it sounds that way when I hear it discussed.  Because what normally follows is the argument that, because of the “blurred” line between work and home, a metaphor most commonly described with a  visual of a worker whose Blackberry must be surgically removed from his hand, employers must permit employees a bit of “leeway” in their electronic follies.  For example, the story goes, because employees may be expected to respond to a client emergency after normal business hours, they should be permitted to do some online shopping during the work day. Or, another story goes, because employees are working more hours than ever before, they have no choice but to do some online banking from their office.  The need to send personal e-mails, browse the malls of cyberspace, and update one’s Facebook status takes precedent over the need to [gasp] work.

Oh, hogwash.

I just cannot buy into this nonsense.  The argument that employees should retain some right of privacy in the e-mails that they send from the account provided to them by their employers, using the computers purchased, maintained, and serviced by their employers, on a network owned by their employers, using bandwith that their employers intended for use for work-related purposes, is a losing one to me.

Those who argue in favor of this alleged entitlement for online detours during the work day must forget that not all employees are exempt. In fact, most workers are non-exempt, meaning that they must be paid (by their employer) for all time worked in excess of 40 per week.  (More in some states, mind you.)  So , non-exempt employees who take short detours to e-Bay via the information superhighway during working time have one of only two impacts: either they are being paid for something they’re not actually doing—some might call that stealing, or they are getting paid time and a half for it because they need to stay late to get their work completed on time.  There’s also a third option: that the employee completes his or her work in a hurry or in a half-done manner to expedite his access to the Internet.

To me, none of these three is an acceptable solution. Has it really become acceptable to demand we be given the choice to not work while at work?  Maybe the manufacturing sector is the only one that hasn’t lost its collective mind by taking breaks of designated lengths at designated intervals but actually working during the rest of the work day.  Not so novel, really, but seemingly a rarity in the office environment.

Jury Verdict Against Employer Who Accessed Employee's MySpace Page

Posted by Molly DiBiancaOn September 4, 2009In: Privacy In the Workplace, Privacy Rights of Employees, Social Media in the Workplace

Email This Post | Print this Post

Employees love social networking. Some employers also love social networking, especially in the context of recruiting, onboarding, and engagement efforts. But employers are not so crazy about the use of Web 2.0 tools by employees.  The question is often asked whether employers may lawfully access an employee's (or applicant's) social-networking page.  And the answer, as any lawyer worth his oats surely will tell you, is "it depends."shutterstock_34933678

There are a number of different contexts in which this question can arise and each has a different response.  For example, in the hiring context, employers often want to conduct a DIY background check by Googling a candidate or searching for the candidate's Facebook profile.

I've already said plenty on this topic and won't rehash it here.  (See More Good Advice on Best Practices for Use of Social Networks for Employers, Free Podcast: Employers' Use of Facebook, MySpace, and Other Social Networking Sites).  But, generally speaking, this presents only minor (and avoidable) potential legal issues.   

A different context occurs when an employer wants to view a current employee's Facebook or MySpace page.  Add to that the situation where the employer doesn't want the employee to know about it's "investigation" or where the employer sees something it doesn't like and takes adverse action because of it, and you've got an entirely different set of circumstances and associated legal issues.

A recent case in the U.S. District Court in the District of New Jersey is the perfect "flare-gun" case--sending a poignant warning to employers considering similar actions.  In Pietrylo v. Hillstone Restaurant Group, a waiter at the employer's Houston's restaurant created a MySpace page and group.  The group was private--only those who were invited by its creator could access the site. The waiter, Pietrylo, gave access to co-workers, who could then read postings or create postings themselves.

Continue reading "Jury Verdict Against Employer Who Accessed Employee's MySpace Page" »

Computer Fraud and Abuse Act: Government to the Rescue of Employers?

Posted by Molly DiBiancaOn July 23, 2009In: Privacy In the Workplace

Email This Post | Print this Post

Employee theft, especially electronic theft, has been on the rise. Some blame falls on the state of the economy. Another explanation is the current state of technology.  Employees are more savvy with technology today than ever before.  And the workplace is more digital than ever before, so there's more data where employees can find it. Once they find it, they know how to use it, remove it, or, in some cases, destroy it. 

Stories of employees' theft and destruction of their employers' data are scarily commonplace.  Usually, employers are left with little recourse. Although they can, of course, terminate the wrongdoer, this option doesn't compensate the organization for the harm caused. Some employers have looked to the legal system and found the Computer Fraud Abuse Act (CFAA), hoping to find a civil remedy to employers whose computer system has been hacked by an employee.  Some courts have agreed with this interpretation, while others have not.  And some employers are left without recourse, especially those who don't have the resources to detect the source of the breach.   

But wait!  There may be another answer!  The government!

No, really.  The government is here to help. I know, I know, when that investigator from the Department of Labor called, there was no mention of any gratuitous assistance, right? But really, there may be some hope. 3d men in need of help with computer

There have recently been a few high-profile stories of "employees who hack" who are then investigated and prosecuted in criminal court.  Former Philadelphia news anchor, Larry Mendte, is the first such story that comes to mind. Mendte was convicted of computer crimes after the FBI discovered that he hacked into his co-anchor's personal email accounts hundreds of times and leaked personal information about her to the media.  Mendte served time on house arrest and recently was released from the confines of his Main Line property and is free to carry out the terms of his probation from the Jersey Shore. 

Another, more recent story is a real-world example of an employer's worst-case scenario. When LifeGift Center, a nonprofit organ and tissue donation center, terminated its IT director, she accessed the computer network remotely from home.  Once she gained access, she deleted organ-donation database records, invoice files, and database and accounting software.  Danielle Duann, 51, then disabled the computer logging functions on several LifeGift servers and erased the computer logs that recorded her remote access to cover her trail. LifeGift claimed more than $94,9000 in damages from the intrusion.

Enter the government!  The DOJ prosecuted Duann. She was indicted by a grand jury last summer and, in May, pleaded guilty to one count of causing damage to a protected computer. Earlier this month, she was sentenced to a two-year prison term, followed by three years of supervised release, and was ordered to pay the full amount of damages as restitution.

Read more posts on the topic of technology's impact on the modern workforce.

Putting the Computer Fraud and Abuse Act to Use, TV Style

Posted by Molly DiBiancaOn June 2, 2009In: Privacy In the Workplace, Privacy Rights of Employees

Email This Post | Print this Post

Larry Mendte’s ankle bracelet came off yesterday. Mendte completed his six-month house arrest and is free to live out the rest of his two-and-a-half-year probation outside the confines of his Main Line home. The house arrest and probation constitute the sentence he received after pleading guilty to intentionally accessing the private e-mail account of his former co-anchor, Alycia Lane.  image

Mendte was convicted under the Computer Fraud and Abuse Act (CFAA), which makes it unlawful to intentionally access a protected computer without authorization. In the last few years, employers have tried, with mixed results, to put this statute to work against employees who engage in cyber-sabotage.

In January 2009, for example, an employer filed suit under the CFAA against two former sales reps, alleging that the former employees had deleted information from their company laptops after resigning.[1] That case was dismissed, though, in a somewhat disappointing ruling from the District Court, which held that the intended purpose of the CFAA was limited to preventing and prosecuting computer hacking and did not extend to the misdeeds of former employees.

But in February 2009, another federal court declined to dismiss a claim under similar facts.[2] In that case, an employer sued former executives under the CFAA, alleging they’d e-mailed documents to their home computers when they were preparing to compete with the company.

So often, employers want to file a counter-claim in response to what they believe is a bogus suit filed for a former employee. The law rarely provides for this, though. For many employers and their legal counsel, the application of the CFAA to the wrongdoings of former employees is a developing area of the law with great potential.


[1] Lasco Foods, Inc. v. Hall & Shaw Sales, Marketing & Consulting, LLC, 600 F. Supp. 2d 1045 (E.D. Mo. 2009)

[2] Ervin & Ervin Smith Advertising v. Ervin, No. 8:08-459 (D. Neb. Feb. 3, 2009).

The Number of Adults Who Use Online Social Networking Sites Is Skyrocketing

Posted by Molly DiBiancaOn January 19, 2009In: Privacy In the Workplace, Social Media in the Workplace

Email This Post | Print this Post

Teens outrank adults in the use of social networking sites by 30%.  But the popularity of social networking sites is not limited to teenagers.  Currently, one-third of adults in the U.S. have a profile at a site like MySpace or Facebook.  And this number is rising.  In fact, the number of adults who utilize these sites has quadrupled since 2005, according to the Pew Internet & American Life Project’s December 2008 tracking survey. 

See the full survey here:  

What are the consequences of this skyrocketing use?   They can only be imagined.  As we've posted about previously, employers are taking a hard line when they discover what they consider unacceptable conduct by employees.  With more and more adults spending time on sites like Facebook and its more "grown-up" cousin, LinkedIn, it seems inevitable that there will be more and more terminations resulting to online conduct.

News Anchor Given 6 Months' House Arrest for Workplace Privacy Violations

Posted by Molly DiBiancaOn November 24, 2008In: Privacy In the Workplace, Privacy Rights of Employees

Email This Post | Print this Post

Larry Mendte, former Philadelphia news anchor, was sentenced today in federal court after pleading guilty to reading the emails of his former co-anchor, Alycia Lane, and forwarding the information along to reporters, reports the Philadelphia Inquirer.   Mendte was sentenced to three years of probation, a $5,000 fine, and 250 hours of community service.

Mendte, who apologized for his conduct, admitted that he accessed Lane's personal email on more than 500 occasions.  He stated that he was motivated by a "flirtatious, unprofessional, and improper" relationship he'd had with Lane.  Lane was present in the courtroom but did not speak on her own behalf. Lane and Mendte: Delaware Employment Law

For the salacious details of this unusual workplace drama, see our earlier posts:

More Drama at the News Desk: Co-Anchor Suspected of Snooping Through E-Mails
Employee Embarrasses Employer, Who Fires Employee, Who Sues Employer
Prying Eyes: What is "Private" Becomes Even Fuzzier for Employees Who Snoop
ABA Journal Takes Note of Our Newsworthy News Anchors
TV News Anchors' Soap Opera Has the Makings of a Made-for-TV Drama
The Mendte-Lane Saga Concludes With a Guilty Plea and a Lawsuit

 

And what, if anything, can be learned from this latest chapter? Here's what I would offer as the Lessons to Be Learned from the Love-Hate Saga of Larry Mendte and Alycia Lane:

 

  1. Anti-fraternization policies may get some good publicity from this case.  The "flirtatious" relationship between the two co-anchors seems to be, according to Mendte, what sparked his bizarre conduct.
  2. Be careful not to disregard the claims of the co-anchor who cried wolf.  Despite Lane's prior allegations regarding Mendte's alleged snooping, her employer was not inclined to believe her, probably because she'd previously volunteered for the spotlight by appearing on the Dr. Phil show, and other unusually public conduct.  This goes to show that, when receiving a complaint from an employee, not to carry our own biases and preconceived beliefs into the investigation.  Go figure--she might actually be telling the truth!
  3. Privacy is a big deal.  It's a big enough deal that his violation of it landed a very popular local public figure into very hot legal water.  As Mendte is reported to have opined during his sentencing hearing: "When I look back on the story of my life, I can't believe it brought me to this moment. I am ashamed."

Busted: Unemployment Money Spent at the Tanning Salon

Posted by Molly DiBiancaOn October 6, 2008In: Privacy In the Workplace

Email This Post | Print this Post

Stories of technology's effects on employees are everywhere.  Employees are using technology to espouse negative views about their employers.  Employers claim rights to their employees' e-mail accounts--both personal and private, even after the employee resigns, as well as employees' text messages made from the phone the employer provided.  The power of technology has again landed employees in the hot seat, which is likely warmer than the tanning beds they visited at the taxpayers' expense.

image

This time, technology has led to the arrest of more than 30 persons on the unemployment-insurance payroll.  The N.Y. Department of Labor tracked the allegedly fraudulent conduct with a new system that cross-checks the names reported by employers within the state as "new hires" against those on the unemployment list.  Clever, isn't it?

It gets better.  Once the Department generated a list of individuals whose name appeared on both lists, it was able to track the purchases of the unemployment recipients through a debit card that the state issues as part of its unemployment program.  And what were these "newly employed unemployment recipients purchasing with their state-issued debit cards?  Only the essentials, of course--subscriptions to dating websites, tanning salons, and lots of bar bills and restaurant charges.

Both of these new technology initiatives have produced a clear victory for citizens of New York, demonstrating additional benefits employers stand to gain from implementing effective technology measures. 

For a similar story on citizens' misuse of government money, see Workers’ Compensation Claims - A result of bad luck or bad leadership?