What Employers Need to Know about the Computer Fraud and Abuse Act (CFAA)

The Computer Fraud and Abuse Act (CFAA), 18 USC 1030, is a federal criminal statute that prohibits certain conduct involving unauthorized access to protected computers. (A protected computer is for the purposes of this article, any computer used in interstate commerce – so all computers that have internet access are automatically “protected.”) What many people don’t realize is that the CFAA provides criminal penalties for unauthorized access to computers, similar to a trespass or burglary law, and that the statute permits any person who suffers “damage” or “loss” by reason of a violation of the CFAA to maintain a civil action against the violator to obtain compensatory damages and injunctive or other equitable relief. Those terms are quoted because they have a hypertechnical meaning under the CFAA.

This statute is particularly useful to companies that have had their protected computers compromised by outside or inside sources. In general the CFAA is implicated in three types of conduct related to a “protected” computer: unauthorized access of information, exceeding authorized access; and causing “damage.” Some of the violations under the CFAA require that someone has suffered “loss” of $5,000 or more – where “loss” means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service. As you might expect showing “loss” of $5,000 or more is usually not too hard – often merely responding to a security breach will exceed this cost.

The language is deceptively complex. For example, in the absence of unauthorized access or exceeding authorized access, damage must be proven; however, suffering $5,000 or more in “loss” will not automatically constitute damage. While in most cases an employee would violate the CFAA if they gained unauthorized access to a protected computer, courts are struggling with the more typical employment scenario – one where an employee actually has authorized access, obtains information that they are legally entitled to obtain, and then later misuses that information in violation of some obligation they owe to their employer. There is a split in the cases on this issue. Some courts (at this writing the 1st and 7th Circuits) have concluded that an employee may be deemed to have exceeded his authorization or to have acted without authorization when he retrieves confidential or proprietary information from his employer's computers that he has permission to access, but then uses that information in a manner that is inconsistent with the employer's interests or in a manner that violates a contractual obligation.

Other courts have criticized this rationale, holding that the CFAA targets the unauthorized procurement or alteration of information, not its misuse.

In cases where an employee has not gained unauthorized access, or exceeded authorized access, the issue is merely whether the employee caused damages and the employer suffered $5,000 or more in loss. In this context “damage” means any impairment to the integrity or availability of data, a program, a system, or information. This sounds easier to resolve than it is. For example, some courts have held that making copies of files is not a “damage” but other courts have held that copying a secure file to an unsecure location is a “damage” because now such data is easier to obtain. Thus, in those courts that adopt this view, one way an employee could cause “damage” would be to access confidential files on his/her work computer and then e-mail them to an unsecure personal e-mail account (like Yahoo® or Gmail®) or copy them to an unsecure media storage device (like an external hard drive).

If one of your employees has engaged in behavior similar to that described in this article and you would like pursue action under the CFAA, you should contact an attorney.

Michael D. Oliver and Mitchell J. Rothenberg
Oliver@bowie-jensen.com
Rothenberg@bowie-jensen.com

New laws impact the payment of accrued leave and the use of paid time off

Maryland’s recent legislative session produces a mixed bag for employers. First, the good news, Maryland enacted legislation that clarifies when employers are required to pay employees accrued leave up to the separation from employment. The bill corrects a recent decision issued by the Maryland Court of Special Appeals which held that employers must pay employees for accrued vacation upon their separation from employment even where the employer has a policy, which has been communicated to its employees, stating that no such entitlement exists. The new law requires employers to pay out accrued paid leave upon termination of employment only to the extent provided in a written policy that is communicated to the employee prior to their termination. On a less favorable note, Maryland also enacted legislation entitled the Flexible Leave Act, which requires Maryland employers, who provide their employees with paid leave, to permit their employees to use that leave to care for ill family members defined as the employee's child, spouse or parent. While many employers already permitted employees to use their accrued leave for this purpose, some worry that the state mandate could lead to abuses. If you have any questions, please contact J. Nicole Windsor at Windsor@Bowie-Jensen.com

Owe Money on a Promissory Note? Make Sure You’re Paying the Right Person.

A recent case in the Court of Special Appeals of Maryland dealt with the issue of what happens when a debtor makes payments on a promissory note to someone who is not the payee or the agent of the payee. The facts of the case are as follows. In 1998, the debtor, 2019 Brandwine, LLC, entered into a contract to purchase a piece of real property from the owner, Dr. Edward H. Saunders, and executed a promissory note to pay Dr. Saunders monthly payments over a several year period. In 2002, Dr. Saunders died and his long time girlfriend, Francina Mitchell, allegedly told the principal of the debtor that he could make payments to her directly. At this point, Dr. Saunders’ estate had no appointed or designated representatives, and none was appointed for over a year. Before a designated representative of the Estate was appointed, the debtor sent Ms. Mitchell twenty payments of $5,000 each. Ms. Mitchell then placed the money in a joint bank account that she had held with Dr. Saunders, and used some of the money to pay the debts of the Estate and some of the money for her personal expenses.

In making its analysis, the Court held steadfast to the rule of law that a payment on a negotiable instrument must be made to the rightful holder of the negotiable instrument or his/her agent. Just because another individual holds themselves out to be an agent of the holder of a note, or appears to be an agent based on the circumstances, does not mean that a payment made to such a person can act to discharge the original debt.

In this particular case, Ms. Mitchell used a majority of the payments for the benefit of the Estate. The Court ruled that such amounts should be applied to paying off the promissory note, because otherwise the Estate would be unjustly enriched by receiving a “double” payment. However, any sums that Ms. Mitchell used for her personal benefit could not be used to offset the amounts the debtor owed under the promissory note, as Ms. Mitchell was not the legal agent of the Estate, and those amounts were not used for the benefit of the Estate. While the debtor could have pursued those sums in a separate lawsuit against Ms. Mitchell, Ms. Mitchell was not a party to this particular lawsuit.

This case is important to any person currently making payments on a negotiable instrument to someone who is not the original holder of that instrument. The Court suggested that the proper action in this instance would have been for the debtor to place its scheduled payments on the note in an escrow account and wait for a designated representative of the Estate to emerge, rather than simply pay an individual who is associated with the deceased and may or may not be an agent of the Estate.

Mitchell J. Rothenberg
Rothenberg@bowie-jensen.com

Trademark Owners Beware: Fraudulent Companies Try to Collect Fees

If you file a trademark application with the US Patent and Trademark Office (“PTO”), you have put the public on notice of your claim that you you are using (or intend to use) a trademark with your goods and services. While filing an application is certainly recommended, it exposes you to companies who prey on unsuspecting trademark owners. There are many examples of these unscrupulous companies, and there are different triggers that alert them to send you an invoice for their “services.” This article explains some of these examples to help you prevent paying fees to a company whose services you do not need and did not ask for.

The first trigger is the filing of a trademark application. Trademark applications are public record, available to anyone with access to the internet. As the Applicant, your name, address, and any other contact information you included in the application are available in your trademark record, which is promptly put online. Filing your application can trigger a host of offers from fraudulent companies offering to watch your mark, to file international trademarks, to list your mark in a directory, or to pay “registration” fees. These notices often appear as if they come from the government.

The second trigger is the publication of your trademark in the PTO’s Official Gazette. Your trademark is published when an Examining Attorney at the PTO has concluded that your trademark is registerable. The purpose of publication is to allow the public an opportunity to oppose registration of your mark. What it means to these fraudulent companies is that you are about to have a registered trademark, and this is their chance to solicit you with offers for trademark watch services, international registration, and other services.

The third trigger is the renewal of your trademark. A renewal affidavit must be filed between the fifth and sixth years after registration, then again between the ninth and tenth years after registration, and every ten years thereafter. Fraudulent companies can troll the PTO’s records for trademarks that were registered five years ago or nine years ago, and send you offers to file the renewal for you, or even make it seem like they are the PTO and are reminding you of the renewal deadline.

If you receive something in the mail and you are not sure if it is legitimate, your attorney can take one quick glance and determine whether it comes from a reputable source. If you have any questions about trademarks, please contact one of our trademark associates, Kim Grimsley (Grimsley@bowie-jensen.com) or Mitchell Rothenberg (Rothenberg@bowie-jensen.com) or our trademark paralegal Tina Murphy (Murphy@bowie-jensen.com).

WHAT YOU SHOULD KNOW:

· Once you have filed your application and paid the filing fee, there are no other fees for use-based applications, and there is only one further fee for intent-to-use applications, which is paid when you file a Statement of Use ($100 per class). Beyond that, only renewal fees need to be paid. There is no such thing as a “registration fee” or “maintenance fee” for trademarks.

· The PTO will never send you reminders, invoices, or offers for additional services. All fees are paid up front with filing, and it is not the PTO’s job to remind a trademark owner that their mark is due for renewal (there are over three million trademark registrations, after all!).

· Companies that solicit you for trademark “watch services” are typically fraudulent. Watch services can be a valuable way to protect your trademark, as watch services keep their eyes on the PTO’s records to see if people are trying to register similar marks, but a reputable company will not contact you—you must contact them. We recommend Thomson Compumark for trademark watch services.

· Renewing your trademark is relatively easy, and can be done online. Renewal fees are $100 per class for the 6-year Sect. 8 renewal, $200 per class for the optional Sect. 15 Affidavit of Incontestability, and $400 per class for the 10-year combined Sect. 8 and 9 renewal.

· Filing an international trademark application is a complicated and expensive procedure. If you want to pursue an international registration, you should contact an attorney, not a company who claims to be experts at international filings.

· Some companies will use names like “The United States Trademark Protection Agency” to make it seem like they are affiliated with the United States Patent and Trademark Office. If you receive a letter from any entity using a similar name as the PTO, look carefully at it—it should state that they are not affiliated with the PTO somewhere on the letter.