Computer Fraud and Abuse Act In Connecticut

Previously, I have posted about non-compete agreements and the duty of loyalty for employees.  Many times, businesses do not have written contracts to protect confidential and proprietary information from not only competitors and vendors, but also their own employees.  Without a contract, the common law of Connecticut concerning breach of fiduciary duty is one of the ways attorneys can seek to protect business clients against improper use of confidential information.

Another method for attorneys to seek to protect their clients' confidential information stored on a computer system or network is through the federal Computer Fraud and Abuse Act (CFAA).  The CFAA is largely a criminal statute, but is being used more frequently in civil cases on behalf of businesses faced with loss or theft of confidential and proprietary information and trade secrets.   The CFAA, 18 U.S.C. 1030, essentially provides for civil liability for unauthorized access to protected computers with intent to defraud or cause damage.  There are civil enforcement provisions that allow private actions for recoverable loss related to prohibited conduct if a series of factors can be proved in court.

Recently, Peter J. Toren wrote an excellent article in the New York Law Journal  where he detailed methods in which the CFAA might be useful for attorneys to protect client trade secrets and other confidential information.   Peter listed the six factors necessary for proof of damages.  Peter also noted some of the limitations of the CFAA when it comes to employee theft of trade secrets and described the narrow and broad views taken by different courts when interpreting improper access of a protected computer without authorization. Peter further provides some useful tips for businesses on how to construct a policy in light of the different court interpretations of improper access. 

Lee Berlik, publisher of the Virginia Business Litigation Blog, also has a recent post about the series of hurdles necessary for attorneys to prove loss or damages under the CFAA.  Lee's post describes a threshold of $5,000 in value that must fit into the categories of potential loss defined in the CFAA.  Similar to Peter's article, Lee also describes how a case was unsuccessful in court because of insufficient facts to show loss under the CFAA.

In Connecticut federal courts, the reported cases under CFAA, largely have been unsuccessful for a variety of reasons, many of which Peter's article details.  Some cases were dismissed for failing to meet damages thresholds (Register.com v. Verio, 356 F.3d 393 (2004)) , while another case was dismissed because the facts were insufficient for unauthorized access (Cenveo, Inc. v. Rao, 659 F. Supp. 2d 312 2009)).   However, in a recent case, in the federal district court, Judge Vanessa Bryant issued an order of sanctions and for production of electronic devices for forensic inspection in a case based, in part, and the CFAA. (Genworth Financial Wealth Mngmt. Inc., v. McMullan). 

The takeaway here is that the CFAA provides another potential basis for a business to protect its confidential and proprietary information when the information resides on a computer system or network.  Of course, there are a series of factors that must be met before liability can be established.  Some of these factors may not apply and eliminate the CFAA as a method of recovery as we have seen in several reported cases.  However, the CFAA should be considered and evaluated in any case involving unauthorized access of confidential information through a computer system as it provides an additional basis for potential recovery.  Also, advanced planning with sound internal policies might provide a business with a better chance of success under the CFAA.

I will do a post soon on another statute, Connecticut's Computer Crime Act, that may provide additional remedies for improper access of a computer system or network.

 

 

LinkedIn Evidence In A Lawsuit -- It Was Only A Matter of Time

When I started this blog, I decided I would keep an eye on lawsuits related to social networking websites as it seems this type of evidence will soon take the place of the smoking gun email of the last ten years.  The impact of social networking evidence in Connecticut business litigation will continue to grow.

My interest in social networking cases started with a Facebook lawsuit so I made a Facebook category on this blog and discussed some concerns for individuals and Connecticut businesses.  Then Twitter exploded to growth of 1000% last year, so I added a Twitter defamation case and a new category.  And now, its finally here ... I need a  LinkedIn category for LinkedIn lawsuits. 

I do not claim to know about all of the social networking lawsuits out there.  There are also some social networking sites that I ignore, like the dying MySpace.  Nevertheless, I do track cases of interest in this area.  You might also check out Megan Erickson's Social Networking blog as a resource to check on these type of claims or visit Dan Schwartz's Connecticut Employment Law Blog for resources and tips on policies for employers related to social networking.  

The LinkedIn lawsuit involves a non-compete agreement and solicitation of employees by a former employee. Molly DiBianca with The Delaware Employment Law Blog detailed the case in a post about the lawsuit filed by TEKSystems against its former employees.  Nothing strange about this type of lawsuit, only in this case, TEKSystems claims it has evidence of breach of the employment contract arising from post-termination solicitation of its employees through the LinkedIn connections of one of the defendants.  Here is a copy of the lawsuit (go to paragraph 37). 

Molly DiBianca states it is the first lawsuit she is aware of using an employee's LinkedIn account.  She may be right, as I am not aware of another case like it.  Nevertheless, I certainly expect this type of social networking evidence to be the focus of more lawsuits and it was only a matter of time for LinkedIn to be involved in a case with media attention.  In Connecticut, we had our own social networking evidence case with Facebook.  In a bullying case involving Miss Porter's School, Judge Arterton ruled that the plaintiff's postings in an expired account were relevant.   

The way I see it, this is only the beginning.  Soon enough, social networking evidence will be as significant and commonplace as email evidence.  At that point, I'll have to find something else to blog about ....

Business Litigation Roundup

As we head to the new year, here is a round up from some fellow bloggers on contracts, cobra, wage disputes, patents, and oral agreements for limited liability companies. 

The California Business Lawyer Blog offers a very detailed post about contractual relationships  between manufacturers and suppliers.  The focus is on well drafted agreements eliminating the fears and concerns of both sides.

A lot of talk about the AT&T suits in different states for $1 billion dollars for unpaid overtime.  The suits picked up a lot of steam with a recent employee favorable ruling from the federal court in Connecticut allowing the claim to proceed as a class action. Rush on Business covers some tips for businesses to avoid these suits.

Just in time for Christmas, President Obama has extended the COBRA subsidy.  Dan Schwartz's Connecticut Employment Law Blog covers this topic in detail for employers.

Twin Cities Business Litigation Blog has an interesting post on concerns you might have as a shareholder of corporation that fails to follow corporate formalities.  Gavin Craig gives examples of how a shareholder could be exposed to liability.

Anyone who frequently litigates matters involving limited liability companies will tell you that there is not much case law out there in Connecticut.  It is still a developing area of the common law.  Delaware law is often a good option for law in this area because these issues are more frequently litigated by volume in Delaware.  A good resource is the Delaware Corporate and Commercial Litigation Blog.   Two recent posts concerning oral partnerships and LLC agreements are just an example.

PatentlyO hits on some themes for 2010, including an expected increase in patent prosecution and litigation.    They also have a cool picture of heat miser, a childhood classic.

Jeff Mehalic, author of the West Virginia Business Litigation Blog, writes a detailed follow up post to his coverage of the Connecticut dispute between Charter Oak Lending and CTX Mortgage.  Jeff also comments about a post I wrote on the same case.  The case remains significant as it is an example of what can go wrong when a business grows too fast and no written agreements are in place with employees.

Do You Need A Contract To Stop A Former Employee From Competing?

The short answer is yes, a business does need a contract, also known as a "non-compete agreement," to prevent a former employee from fairly competing in business once the employee resigns.  Even with a written agreement, there are limitations on non-compete agreements because they are viewed as a restraint of trade.  To be enforceable, the restrictions in the agreement must be reasonable in time, scope, and geography. The restrictions also must be reasonable in relation to legitimate business interests you are seeking to protect.   

A poorly drafted agreement, or no agreement at all, can leave a business with little legal recourse to stop a former employee from fair competition once the employee resigns.  Simply put, the law in Connecticut permits fair competition upon resignation.  However, the lack of a written agreement does not give free license to employees to unfairly compete in all circumstances. 

For example, what about an employee that starts competing against your business without your knowledge while continuing to work for you?  Is this fair competition that should be freely permitted?  Depending on the circumstances, this type of conduct can be actionable in a civil case for damages.  The actionable conduct is breach of the employee's common law duty of loyalty, which exists without a written agreement in certain circumstances.  There are also statutes in Connecticut that can protect businesses in certain situations that do not require contracts such as unauthorized computer access or misappropriation of trade secrets.   

I just read a story about a recent case that demonstrated some of the legal issues involved when there are no contracts in place with former employees.  According to the small business report by Carlye Adler of CNN, Charter Oak Lending, located in in Danbury Connecticut, lost a trial against several former employees who allegedly left to work for a larger company, CTX Mortgage.  Charter Oak alleged it lost more than a third of its business and a million dollars in fees after a sudden departure of 10 employees to CTX. The litigation lasted four years and ended with a defense verdict for the former employees. Charter Oak is appealing the decision. 

It appears that the decision against Charter Oak was based in part on the lack of contracts and the categorization of the defendants as independent contractors rather than employees.   The Trade Secrets Blog by Womble Carlyle picked up the story and had an interesting take focused on pure versus unfair competition.  The blog post supports the legal concept that a line can be crossed turning pure competition into unfair business. 

Charter Oak's appeal of this case will be interesting to follow.  The outcome will likely depend on what evidence existed at trial to demonstrate unfair competition prior to the employees' departure along with consideration of the duty of loyalty.  The takeaway is that it is always better to have written agreements to protect your business' customers, client lists, and confidential information.  However, the lack of such an agreement will not always give free license to former employees to unfairly compete in all circumstances.   A close examination of the facts of each case must be undertaken to consider common law and statutory remedies that do not necessarily require agreements. 

Connecticut Defamation Law, The Internet, And Social Networking

In the Business Torts category of this blog, I recently covered the basic law in Connecticut concerning interference with business relationships.  Today's post concerns another business tort known as "defamation" and how it intersects with the growing use of social networking sites.

There already have been several lawsuits for defamation arising out of use of social networking sites, such as Twitter and Facebook. For example,  The California Defamation Blog lists several celebrities involved in defamation cases, including Courtney Love who was sued by a fashion designer for defamation after a series of derogatory Twitter posts by Love.  Craig Kanalley of Chicagonow.com reported that a property owner sued a tenant for disparaging Twitter comments. The Chicago Tribune recently reported on a defamation lawsuit brought by a mother and her son after a phony Facebook profile was created showing the son was a racist.   

Should Connecticut businesses be concerned?  Clearly, the type and variety of these suits are on the rise. In legal circles, these type of claims have a category of their own called "cyber slander" or "internet defamation."  Given the popularity in use of social networking sites, and the ease in which statements can be broadcast to millions, it is safe to  predict that more defamation cases will be filed in the future. 

Connecticut businesses can be affected by defamation suits involving social networking sites and the internet in a number of ways, such as:

  • Employees making comments about a competitor
  • Employees making comments about supervisors or co-employees
  • Employees making comments about the company's products
  • Competitors making derogatory comments about the company
  • Phony Facebook or Twitter profiles
  • Derogatory comments about the company 

In Connecticut, defamation encompasses defamation by spoken (slander) and written (libel) words. In general, to raise a proper claim for basic defamation, a plaintiff must show that:

  1. A defamatory statement was made
  2. The statement identified the plaintiff to a third person
  3. The statement was published to a third person
  4. The plaintiff's reputation suffered injury as a result of the defamatory statement

In regards to businesses, there is also a defamation claim sometimes referred to as "commercial disparagement" or "trade libel."  For this type of claim, a plaintiff must prove disparagement of a business' goods or services by falsehoods published or communicated to a third person.

With the ease of publication to millions over the internet, it is easy to see how someone might publish a defamatory comment whether it be on a blog, social networking site, or website.   Chances are, if you are in business, either you, someone who works for you, or a competitor has commented about the business in cyberspace.

For a business, the best way to avoid a lawsuit for defamation as a result of employee use of sites such as Twitter and Facebook is to have a written policy that governs employee use.  The details of each policy will differ depending on your business, but clearly the policy should prohibit any defamatory or derogatory comments about the business, employees, or competitors.

In situations where a competitor or customer disparaged your business' products or services, a business may want to consider legal action and determine if grounds exist to issue a cease and desist letter, a take down letter, or initiate a lawsuit.  Internet defamation can ruin a business' reputation overnight and should be addressed immediately regardless of whether the business pursues legal action.   

For a business, whether legal action is taken may depend on the severity of the disparagement and the damage done.  In some cases, a cease and desist or retraction is a practical solution especially when a defamation suit would bring added attention to the matter.  In other cases, legal action, such as a defamation lawsuit, may be required to stop ongoing damage or serious problems.

Regardless of the situation, Connecticut businesses should, at a minimum, monitor cyberspace for defamatory comments.  Comments that might lead to a lawsuit could come from your own employees, a competitor, or a disgruntled customer.  A written policy is a good way to minimize risks of employee comments.  As for competitors and customers, Google alerts is a good way to monitor use of a business' name on the Internet. The alert will send you an email every time your business name is found on the internet. 

First Amendment Suit Filed Against Hartford Courant Following Termination of Columnist

I was tipped off by a reader that George Gombossy, the consumer columnist at Ctwatchdog, would be filing his wrongful termination suit against his former employer the Hartford Courant.  Sure enough, the lawsuit now has been filed and made its way around cyberspace today.  

Hartford Attorney Mark Dumas posted a copy of the lawsuit on Twitter.  You can read the lawsuit here (download).  You can also read about the suit at the Laurel and in a post by Christine Stuart at CTnewsjunkie.

Mr. Gombossy also posted the lawsuit on his new blog, ctwatchdog.com.  You can read Mr. Gombossy's comments on the suit here.  He claims that "Courant management attempted to pressure [him] from writing negative columns about key advertisers."  He claims that his termination followed after he wrote a column about Sleepy's that the Courant never published.  

The Courant denied the allegations according to an article today by Kenneth Gosselin. The Courant also issued a statement calling Mr. Gombossy's claims a "mischaracterization."

The focus of relief for Mr. Gombossy's lawsuit is Connecticut's free speech statute, which provides for damages in the event of termination for exercise of certain first amendment rights.   Dan Schwartz at the CT Employment Law Blog dissected the suit earlier today and provided a possible defense to the free speech claim. 

As noted by Dan Schwartz, nothing needs to happen in the lawsuit until November 13th, at the earliest, when the Courant has to file a response to the lawsuit.  Based on its statement on the case, it appears that the Courant intends to vigorously defend the suit.  We will have to watch how this case develops. 

Dispute Between Business Partners Ends In Dissolution and Double Damages Under Connecticut Wage Act

In Saunders v. Firtel, a decision to be officially released on September 22, 2009, the Connecticut Supreme Court upheld an award of double damages under Connecticut's wage and hour laws in what amounted to a dispute between two business partners, Barry Saunders and Burton Firtel.  The supreme court also upheld judicial dissolution of a company owned by the partners.  The case highlights the complications that can arise between partners when one partner is also an employee in the business.  

In this case, Saunders became part owner of a company that Firtel previously formed by himself.  Saunders also became an employee of the company as part of a larger business relationship.  This is not an uncommon arrangement in business, especially when a small business is purchased by a larger company.    Saunders and Firtel also formed another limited liability company together as equal owners. The business relationship was documented with an operational agreement. 

Although the partners successfully operated the business for years, a dispute arose out of unpaid wages after Saunders unsuccessfully tried to change the compensation structure of the business relationship.  In response, Firtel fired Saunders.  Saunders brought a lawsuit in Connecticut state court for unpaid wages claiming he was an employee.  He also sought to dissolve the limited liability company formed with Firtel. 

A few months ago, Connecticut's wage and hour laws were in the national spotlight because of the scandal with AIG's bonus plan for its employees in Wilton, Connecticut.    AIG claimed that it had to pay the bonuses because it feared double damages under Connecticut's wage and hour laws.  In this instance, Saunders brought his case in court relying on the same provisions that AIG feared. 

Connecticut's unpaid wage law, General Statutes section 31-72 ,provides that:

When any employer fails to pay an employee wages . . . the employee may recover, in a civil action, twice the full amount of such wages, with costs and such reasonable attorney's fees as may be allowed by the court . . 

To recover double damages, although not mentioned in the statute, courts require a finding of bad faith, arbitrariness, and unreasonableness by the employer.  In Saunders' case, he won because the trial court found that the failure to pay was willful.  What might seem strange about the case is that Saunders was not only an employee, but he was also a 49% stockholder and an officer in the company he sued to obtain double damages.  Firtel was a 51% owner, and the President. 

Dan Schwartz's Employment Law Blog has a nice summary of the supreme court's treatment of how Saunders qualified as an employee as well as the implication of the decision on employers.  I tend to agree with Dan that there is no significant impact on employers because if wages are earned, the wages should be paid regardless of the business relationship.

I think the case does highlight important considerations for business partners.  The case demonstrates how a breakdown in the relationship between two business partners can turn into a dispute where one partner effectively ends up in the shoes of the employer subject to wage and hour laws.  This was probably not intended and it is unlikely that Saunders and Firtel viewed themselves as employee and employer.  In fact, they appeared to be nearly equal partners.

The case is also another example of a once successful business partnership ending in arguments over compensation and written agreements.  It further shows that dissolution of a company is another judicial remedy, along with disassociation and expulsion in partnerships, for a company that can no longer operate in a practical manner. 

 

Social Networking Lawsuits Are Big Risk to Business

I just read an excellent article posted on Law.com from the New York Law Journal on social networking and challenges to business owners and their legal counsel.  The authors Christopher Boehning and Daniel Toal focus on a new emerging problems associated with electronic discovery of social networking data.  The authors also point out many of the potential problems for employers and businesses related to social networking sites.

When Facebook started exploding in popularity, you could see that the future in communication was social networking.  Boehning and Toal cite to a New York Times articles that indicates the future is now upon us as more people spend time on social networking sites than e-mailing.  The authors correctly point out something I emphasize to all my business clients:  businesses need to have a policy on how to handle social networking sites like Facebook, MySpace, LinkedIn and Twitter.  The policy should cover the business' use of such sites and use by employees.  Policies on preservation of the data should also be included as social networking data is akin to the new email.

Lawsuits involving some aspect of social networking sites are increasing in frequency from across the country. Take for example the recent jury verdict in New Jersey against Hillstone Restaurant for violation of the Federal Stored Communications Act. 

In that case, the employers accessed an employee MySpace group that was dedicated to criticizing the employer.  Although the verdict amount was relatively small, the implications are far reaching.  This case was reported on by Charles Toutant in the New Jersey Law Journal.  The employees' trial brief is a good read and spells out some of the arguments in favor of employees' rights to privacy with social networking sites. 

The outcome in the New Jersey case may have been different if the restaurant had a policy addressing use and access to social networking sites.  Businesses will have different concerns when it comes to adopting a policy, and no policy will cover every situation.  However, the lack of any policy at all is likely to lead to problems and potential litigation.  The best way to avoid litigation is to implement a written policy on use and access to social networking sites.