Sign in Subscribe
Fraud

Court Ruling Limits Employers' Ability to Pursue Employees for Violating Computer-Use Policies

Strategic Insights

— 2 min read

The U.S. Court of Appeals for the Third Circuit has issued a significant ruling in NRA Group, LLC v. Durenleau et al., addressing the issue of whether violating an employer's computer-use policy constitutes a claim under the Computer Fraud and Abuse Act (CFAA). The court's decision, announced on August 26, 2025, holds that breaching a computer-use policy does not create a CFAA claim unless code-based hacking is involved. Additionally, the court ruled that passwords disclosed by an employee are not trade secrets under state and federal law. This ruling has implications for employers in Delaware, New Jersey, Pennsylvania, and the U.S. Virgin Islands, as they will no longer be able to pursue claims against employees who violate company policies.

Key Takeaways:

  • The U.S. Court of Appeals for the Third Circuit ruled that violating an employer's computer-use policy does not create a claim under the Computer Fraud and Abuse Act (CFAA) unless code-based hacking is involved.
  • The court determined that passwords disclosed by an employee are not trade secrets under state and federal law if they do not have independent economic value.
  • Employers no longer have a claim under the CFAA against employees who breach company policies, limiting their ability to pursue claims against employees.
  • The ruling impacts employers in Delaware, New Jersey, Pennsylvania, and the U.S. Virgin Islands.
  • The court emphasized that employers still have tools to protect their confidential information and business interests.
  • The case, NRA Group, LLC v. Durenleau et al., was decided by the U.S. Court of Appeals for the Third Circuit on August 26, 2025.
  • The defendant employee, a current employee, accessed company information without violating the CFAA by breaching a company policy.
  • The reassignment of a company account password, even if containing multiple account credentials and passwords, is not a violation of the CFAA.
  • Company systems and account passwords that lack special formulas or algorithms and have no economic value are not considered trade secrets.
  • Tools for employers to protect their confidential information include implementing robust policies, storing sensitive information securely, and conducting regular employee training.
  • Confidential information and business interests can still be protected through other means.

Statistics:

  • No specific statistics were provided in the source material related to this case.
  • However, note the following:
  • The case was decided by the U.S. Court of Appeals for the Third Circuit on August 26, 2025.
  • The defendant employee's access of company information without violating the CFAA occurred in January 2021, during her time out sick with COVID-19.

Sources:

  • NRA Group, LLC v. Durenleau et al., U.S. Court of Appeals for the Third Circuit, August 26, 2025.

Read more