Breaking your employer’s computer policy isn’t a crime

Computers have become an essential part of many companies, and many of these companies have adopted policies for how their employees should use computers while they’re at work. Obviously, should an employee break that policy, the company is well within its rights to discipline them, but the government took things a step further in the case of Gilberto Valle by actually pursuing legal punishment. The case itself is much more complex and surprisingly interesting, but for the purpose of this article, the only part that really matters is the fact that an American appeals court has ruled that breaking your employers computer policy isn’t a crime. 

The United States Court of Appeals for the Second Circuit issued an opinion rejecting the government’s attempt to hold an employee criminally liable under the federal hacking statute—the Computer Fraud and Abuse Act (“CFAA”)—for violating his employer-imposed computer use restrictions. The decision is important because it ensures that employers and website owners don’t have the power to criminalize a broad range of innocuous everyday behaviors, like checking personal email or the score of a baseball game, through simply adopting use restrictions in their corporate policies or terms of use. The court also ruled that the government cannot hold people criminally liable on the basis of purely fantastical statements they make online—i.e., thoughtcrime. The case, United States v. Gilberto Valle, received a lot of attention in the press because it involved the so-called “cannibal cop”—a New York City police officer who was charged with conspiracy to kidnap for posts he wrote on fetish websites about cannibalism. Valle was also charged with violating the CFAA for accessing a police database to look up information about people without a valid law enforcement purpose, in violation of NYPD policy.