How Do You Violate the Computer Fraud and Abuse Act? SunPower Lawsuit Shows How!

A new lawsuit has been filed by SunPower against 5 former employees and it’s rival SolarCity alleging violations of the Computer Fraud and Abuse Act. This is a good one to look at if you want to see how to violate the CFAA with style — especially if you are an soon-to-be-departing employee and you don’t want there to be any doubt until the 9th Circuit resolves the access issues in US v. Nosal.

You’re following me on this, right? Ok, good, let’s have a little test to see: do you know which of these two tidbits of factual information I am talking about that is so important, (a), (b), or both?

(a) “Leyden connected at least three personal USB storage devices, commonly known as flash drives, to SunPower’s internal computer network and downloaded thousands of sensitive sales files and documents in clear violation of the company’s internal guidelines, said SunPower, which said it conducted a forensic analysis of its computer systems before filing the lawsuit.”

“”The forensic evidence indicated that Leyden copied at least thousands of files containing SunPower confidential information and non-confidential proprietary information to these devices,” said the complaint. “These files included hundreds of quotes, proposals, and contracts, as well as files containing market analysis, forecast analysis and business analysis.””

“Leyden also accessed highly confidential data from SunPower’s SalesForce database, according to the lawsuit, including information on major commercial customers who accounted for more than $100 million in sales in 2011.”

OR

(b) “Aguayo, who joined SunPower in 2005, had accessed his company e-mail account after Nov. 1, his last day of employment. It said it than discovered that Aguayo had forwarded several e-mails containing customer information, price lists and market reports to his personal e-mail address in mid-November.”

Lets hear it, what is your answer?

Now, to give credit where credit is due, I first read about this in a nicely done article by Dana Hull (@danahull) from which the above quotes were taken: SunPower sues five former employees and rival SolarCity for data theft and computer fraud. Ms. Hull was kind enough to include a copy of the Complaint in her article so give her a shout-out and tell her thank you for making it a little easier for you to get a hold of this fun reading!

Published by Shawn E. Tuma

Shawn Tuma is an attorney who is internationally recognized in cybersecurity, computer fraud and data privacy law, areas in which he has practiced for nearly two decades. He is a Partner at Spencer Fane, LLP where he regularly serves as outside cybersecurity and privacy counsel to a wide range of companies from small to midsized businesses to Fortune 100 enterprises. You can reach Shawn by telephone at 972.324.0317 or email him at stuma@spencerfane.com.

Join the Conversation

2 Comments

Leave a comment

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Discover more from Business Cyber Risk

Subscribe now to keep reading and get access to the full archive.

Continue reading