Lasco Foods v. Hall and Shaw: Can an Employee Be Liable Under Federal Wiretap Laws for Accessing an Email on a Company Laptop for Purposes Adverse to the Company?
Judge Jean Hamilton's recent order in Lasco Foods, Inc. v. Hall and Shaw Sales, Marketing & Consulting, LLC, E.D. Missouri (October 26, 2009) held that an ex-employee who accesses information on a company-issued laptop for a purpose adverse to the company can be liable under the federal Stored Communications Act (SCA). Judge Hamilton's ruling also suggests that even current employees can be held liable under the SCA as well, if they access information from a laptop for a purpose that violates their duty of loyalty to the company.
This ruling is important, because the SCA provides for criminal penalties, as well civil actions, against offenders. 18 U.S.C. §§ 2701(b), 2707. Tens of millions of U.S. employees are issued company-owned laptops, and countless employees download information from these computers for purposes adverse to their former employer's interests, both during and after leaving the company. Under Judge Hamilton's ruling, many thousands of these employees theoretically stand in jeopardy of federal prison time.
But is Judge Hamilton's ruling right? At least one other recent ruling suggests that the SCA cannot be used in this situation at all. See Thule Towing Systems, LLC v. McNallie, E.D.Mich., No. 2:09-cv-10905, Order (July 15, 2009). Other case law suggests that the SCA only reaches employees who access to emails and other communications stored on company-owned computers has been expressly revoked.
Judge Hamilton's decision was based on SCA Section 2701, which provides that "whoever (1) intentionally accesses without authorization a facility through which an electronics communication service is provided; or (2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such a system shall be punished as provided in subsection (b) of this section." 18 U.S.C. § 2701(a).
Here, Lasco had alleged that the defendants, Shaw and Hall, were long-time Lasco sales executives and had been provided with company laptops for use in company business. In 2008, Shaw and Hall decided to start a competing restaurant food supply. Both before and after Lasco became aware of this new business, but which they were still Lasco employees, the defendants allegedly "accessed, printed, copied and/or downloaded" a substantial amount of data from their laptops, as well as from Lasco's network, for use in their competing business. See Lasco Foods, Inc. v. Hall and Shaw Sales, Marketing & Consulting LLC, E.D.Missouri, No. 4:08-cv-01683, Third Amended Complaint (May 15, 2009).
Using principles of agency laws, Judge Hamilton reasoned as follows:
"While Lasco afforded Defendants access to its computers, networks and information for purposes of their employment, Lasco alleged that Hall and Shaw accessed Lasco's Information to benefit the interests of Defendants, not Lasco. Defendant Hall and Shaw's authorization to access this information ceased when they breached their duty of loyalty to Lasco and their employment terminated" (emphasis added).
Noting that Lasco had pointed to specific emails and information that Hall and Shaw had accessed after their termination -- and hence after their authorization had been revoked -- Judge Hamilton concluded that the SCA could apply. While Judge Hamilton's ruling focus on the defendants' post-termination access to emails, her ruling appears to say that the SCA could apply to Hall and Shaw pre-termination access to emails, as well.
By contrast, the Thule decision rejected the applicability of SCA to this situation. In Thule, a company attempted to use the SCA to sue an employee who had allegedly used information from a company laptop for a competing business, despite his agreement to only use the computer for the company's benefit. The Thule court focused on a section of the SCA that Judge Hamilton ignored -- 18 U.S.C. § 2702 -- which deals with disclosure of stored communications. Section 2701(a) provides that "a person or entity providing an electronic communication service to the public shall not divulge to any person or entity the contents of a communication while in electronic storage by that service." The SCA does not contain similar prohibitions for persons who don't fit into the category of "communications service providers." The Thule court concluded that means that "a person who does not provide an electronic communications service . . . can disclose or use with impunity the contents of an electronic communication unlawfully obtained from storage" (citing Wesley College v. Pitts, 974 F.Supp. 375, 389 (D.Del. 1987) (emphasis added). For the Thule court, this meant that a SCA claim cannot be brought against an employee whose employer has authorized his use of a computer.
Neither the Lasco nor the Thule decisions are satisfying. On one hand, the Thule decision essentially ignores the fact that the SCA prohibits obtaining or altering stored communications, even if these are never disclosed or used. 18 U.S.C. § 2701(a).
On the other hand, under Judge Hamilton's reasoning in Lasco, any employee who accesses emails on a company laptop for interests adverse to the company could find herself the target of an SCA action -- even for his/her pre-termination activities. It is hard to imagine that Congress intended the SCA to go this far. At the very least, Judge Hamilton's ruling in Lasco should be confined to only permit SCA actions against employees who lack any authorization to access company computers -- either by having never been given authority in the first place, or having had their authority expressly revoked by the company. See LVRC Holdings, Inc. v. Brekka, 9th Circuit, Case No. 07-17116 (Sept. 15, 2009) (adopting this rule for CFAA cases).
David D. Johnson is a business lawyer whose practice focuses on litigation and other issues relating to digital media and consumer electronics companies. David can be contacted at (310) 785-5371 or DJohnson@jmbm.com.
