Labor & Employment Law Daily Wrap Up, PRIVACY, COMPUTER FRAUD—3d. Cir.: Conviction vacated where employer had not rescinded resigned employee’s computer access, (Dec 10, 2025)

By Todd Harrison, J.D.

The employer had not taken a single step to rescind permission and no contract linked the employer’s authorization to employee status.

Vacating the conviction of an employee’s co-conspirator in a case concerning charges brought under the Computer Fraud and Abuse Act (CFAA), a divided Third Circuit held that an employee is no longer authorized to access an employer’s computer when the employer rescinds their permission to use it. In the absence of a contract saying so, an employee’s resignation alone does not rescind the employer’s authorization for them to use the employer’s computer, said the court. Dissenting, Judge Montgomery-Reeves contended that a jury can consider an authorizing party’s actions when determining whether an authorizing party acted “without authorization,” and would have affirmed because the district court correctly allowed a jury to consider whether the cessation of employment impliedly rescinded authorization in this case (United States v. Eddings, No. 23-3017 (3d. Cir. Dec. 9, 2025)).

On August 14, 2014, an employee started a job helping the Prostate Cancer Foundation (PCF) organize a fundraiser. To plan the event, the employee needed to read, write, and send emails on behalf of a PCF board member. PCF installed a link on the employee’s personal computer that would enable her to use the board member’s account without knowing the password herself.

Resignation. After a few days, the employment relationship deteriorated. The employee was under the impression that she was hired for a full-time position, while the employer considered it a temporary role with future consideration for full-time employment. On August 21, the employee resigned, asking for payment for the days she worked and reimbursement for expenses. PCF neglected to pay and ceased communications with the employee.

Computer access. To negotiate payment, the employee enlisted the help of a friend. The employee still had access to the board member’s email account, which the employee used to send her friend internal documents. The friend emailed PCF’s CEO, threatening to release the documents unless PCF satisfied the employee’s demands for lost wages along with her own demand for a 25 percent fee. On October 1, PCF remotely disabled the link on the employee’s computer.

Criminal charges. Subsequently, the two were indicted by a grand jury on four counts of violating the CFAA, which in relevant part prohibits accessing another’s computer “without authorization.” The case went to trial.

After the government presented its case-in-chief, the friend and alleged co-conspirator moved under Federal Rule of Criminal Procedure 29 for a judgment of acquittal, contending the government failed to prove the employee had accessed the board member’s account without authorization because PCF did not lock her out of the account until October 1. The district court denied the motion.

During the prosecutor’s closing argument, he insinuated the government would have charged the two with extortion if they had been successful in procuring any money.

Jury instructions. To define the phrase “without authorization,” the district court gave the jury an instruction the alleged co-conspirator requested, followed by two additional sentences of its own devising: “Once given, a person’s authorized access may be revoked. Whether authorized access has been revoked or, whether the cessation of employment rescinds authorization, is a factual question for you to decide as the jury.”

The jury found the two guilty on all counts. The employee died shortly thereafter. The co-conspirator was sentenced to 18 months’ probation, six of which were served on home confinement.

Appeal. Following her conviction, the co-conspirator moved under Rule 33 for a new trial on several grounds, including that the jury instruction on authorization misstated the law and that the prosecutor’s closing remarks about extortion were inappropriate. The district court denied the motion.

On appeal, the co-conspirator challenged the denial of her Rule 29 motion for judgment of acquittal and the denial of her Rule 33 motion for a new trial on the basis of the jury instruction and the prosecution’s remarks about extortion. The Third Circuit began by addressing her arguments concerning the CFAA.

Authorization. To prove the co-conspirator violated the CFAA with the employee, the government had to prove that she: “(1) intentionally (2) accessed without authorization... a (3) protected computer and (4) thereby obtained information.” Here, the appeal concerned only the second element—authorization.

Two facts were significant to framing the issue, explained the court. First, there was no evidence that PCF conditioned the employee’s permission to access the board member’s account on her continued employment. Although it was true she had signed a confidentiality agreement governing her access to certain confidential information, that agreement did not impose any restrictions on her access, let alone specify that her access would end if she resigned. Second, the record contained no evidence the employer took any affirmative step to rescind permission to use the account after she had resigned. It only did so upon revoking her access on October 1.

Resignation not enough. Whether an employee is authorized to access her employer’s computer is up to the employer, said the court. Only the employer has the power to grant authorization, and only it has the power to rescind that authorization. In the absence of a contract saying so, an employee’s resignation alone does not rescind an employer’s authorization for her to use her employer’s computer.

Just as authorization can be given, continued the court, it can be taken away. But by whom? According to the court, in the employment context it must be by the employer. “Absent more, an employee’s resignation does not cancel her employer’s authorization,” said the court, explaining that an employee’s resignation is not the employer’s action, it is her own.

“An employee cannot rescind the permission her employer gave her any more than an employee can provide permission her employer has not given,” explained the court. Thus, absent a prior agreement, an employee’s resignation does not revoke her employer’s authorization. The employer must perform some affirmative act to revoke the authorization.

Brekka. According to the government, the Ninth Circuit’s decision in LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009), states that an employee’s resignation alone rescinds his employer’s authorization. The court here was not convinced.

Although the record was murky in Brekka, the employee at the center of that dispute did not unilaterally walk away from his employment, observed the court. It appeared that after contract negotiations broke down, he was either fired or he and the company agreed to part ways. Either way, the issue concerned the employer’s conduct as well as that of the employee.

Further, the court observed that the government’s reading was inconsistent with how the Ninth Circuit has read Brekka since. In Accord Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), the Ninth Circuit “distill[ed]” from Brekka that “a defendant can run afoul of the CFAA when he or she has no permission to access a computer or when such permission has been revoked explicitly.”

Narrow holding. On this point, the court pointed out that its holding was narrow. It was not tasked with deciding whether an employer revokes an employee’s authorization by firing her, nor did it rule out that an employer may provide by contract that resignation terminates authorization. “Authorization might be a function of employment, but only so long as the employer makes it so,” said the court.

In addition, the court did not prescribe how an employer must act to revoke authorization, noting that it might not take anything more than an email notifying an employee that she no longer has authorization to access its computer systems. Regardless, absent an applicable contract or policy, it is incumbent upon the employer to act. So long as there is evidence that the employer took some step to rescind permission, it is up to the jury to decide whether that action was enough.

Further, the court held that an employer need not revoke access to revoke authorization. One can obtain access without authorization, such as by hacking into an employer’s system, and one can have authorization without access, such as being locked out of the system for failing to complete a required password update.

Rule 29. Turning to the case at hand, the court found that, as a matter of law, the jury could find the employee accessed the board member’s emails without authorization only if there was evidence PCF affirmatively rescinded her permission to use the account. There was no evidence that it did. Thus, the district court should not have denied the co-conspirator’s Rule 29 motion for judgment of acquittal.

Error in jury instructions. According to the district court’s jury instructions, “whether the cessation of employment rescinds authorization, is a factual question for you to decide.” Not necessarily, said the appellate court, reiterating that resignation alone does not revoke an employer’s authorization.

In this instance, the instruction opened the door for the jury to find that the employee accessed the board member’s account without authorization simply because she accessed it after she had resigned. “And there is every reason to think the jury walked through that door when there was no evidence PCF took steps of its own to revoke its authorization,” said the court. Accordingly, the jury instruction warranted vacating the co-conspirator’s conviction.

Extortion remarks. Finally, the co-conspirator argued she deserved a new trial because the prosecutor briefly suggested the government would have charged her with extortion had money exchanged hands. The court was not moved.

Although the comments may have been inappropriate, they were brief, consisting of two sentences among nearly 50 pages of closing arguments, observed the court. Further, the district court issued a curative instruction. As such, the district court did not abuse its discretion in refusing to grant a new trial.

In conclusion, the court held that the co-conspirator did not violate the CFAA, and therefore vacated her conviction and remanded with instructions to enter a judgment of acquittal.

Dissent. Dissenting, Judge Montgomery-Reeves contended that there was nothing in the CFAA’s text, context, legislative history, or case law requiring employer recission to terminate authorization. Instead, argued the judge, both employee resignation and employer recission are facts a jury must consider in determining whether authorization exists.

The case is No. 23-3017.

Judge: Ambro, T.

Attorneys: Paul G. Shapiro, Office of U.S. Attorney, for the U.S. Benjamin B. Cooper (Daigle Cooper & Associates) for Frances M. Eddings.

MainStory: TopStory ComputerFraudPrivacy Procedure WhiteCollarCrime DelawareNews NewJerseyNews PennsylvaniaNews GCNNews