Labor & Employment Law Daily Wrap Up, PRIVACY, COMPUTER FRAUD—3d Cir.: No CFAA violation for NRA Group employees who contravened computer-use policies, (Aug 27, 2025)

By Kathleen Kapusta, J.D.

“In the wrong hands, the law becomes a hammer in search of a nail.”

Absent “evidence of code-based hacking, the CFAA does not countenance claims premised on a breach of workplace computer-use policies by current employees,” the Third Circuit declared, holding for the first time that the text and purpose of the Act “does not turn these workplace-policy infractions into federal crimes.” Affirming summary judgment in favor of two NRA Group employees who had been sued by the company after they violated several of its computer-use policies, the court also held that “passwords that protect proprietary business information are not themselves trade secrets under federal or Pennsylvania law” (NRA Group, LLC v. Durenleau, No. 24-1123 (3d Cir. Aug. 22, 2025, vacated and amended Oct. 7, 2025, rehearing granted)).

Because NRA, a debt-collection company, has access to personally identifiable information about individual debtors, it has comprehensive written data protection and computer use policies. Its systems are also protected by digital firewalls so employees can access the systems only when they are physically present in the office or by using a company-issued laptop and virtual private network. They cannot access the company’s systems through any personal or mobile devices but can access their NRA email accounts on their cell phones.

TODAY!!! In January 2021, the company’s senior manager of compliance services had been out sick with COVID for more than a week. She did not have a company laptop so she asked her supervisor to look through her papers to see if anything needed attention. The supervisor discovered a deadline that day to renew an expired license. Because she was not at work, the senior manager did not have access to the required registry in order to pay the fine. When the CEO was informed of the issue, he told the senior manager that it was her problem, that she needed to fix it by the end of the day, and that she needed to get the license renewed “TODAY!!!”

The senior manager called a coworker and shared her NRA system credentials. The coworker logged into the NRA network as the senior manager, accessed a spreadsheet created by the manager that contained her passwords for dozens of company systems and accounts, and sent her the login information for the registry. The manager sent that information to her supervisor, who logged into the registry and paid the fine. The following day, the coworker sent the spreadsheet to the manager’s work email.

Collection records. Over the years, the senior manager also moved work files, specifically debt accounts, to the compliance workgroup to ensure she would be credited for performance bonuses. When she learned that collectors were moving the accounts out of her workgroup, she alerted her supervisor who then requested an audit. After the audit revealed that the manager had moved hundreds of accounts into her workgroup, she was given a final warning. She resigned two weeks later. Her coworker was fired a month later after an internal investigation revealed that she had been the one to log in to the manager’s account, in violation of the company’s computer-use policies, to access and email the spreadsheet.

Sexual harassment. During her employment, the manager had also complained about sexual harassment, including by the CEO, who allegedly commented on her appearance and asked for naked pictures, among other things. She further claimed she was slapped in the face by an executive after complaining about another employee and her coworker claimed she had been sexually harassed “all day, every day” during her six-month tenure with the company.

Lawsuit. The company subsequently sued the manager and coworker, alleging they violated the Computer Fraud and Abuse Act, the Defend Trade Secrets Act, and the parallel Pennsylvania Uniform Trade Secrets Act. It also asserted state-law claims of civil conspiracy, breach of the common-law duty of loyalty, and fraud. The two employees asserted counterclaims for sexual harassment, negligent hiring and retention, and retaliation under federal and state law.

Lower court proceedings. On cross-motions for summary judgment, the district court granted the employees’ motion on the employer’s claims against them and granted in part their motion on the sexual harassment and related claims, leaving some of those claims pending. The employer then moved to certify the judgment for the employees under FRCP 54(b), which permits a district court to “direct entry of a final judgment” for some “claims or parties” if the court “determines that there is no just reason for delay.” The court did so as to its judgment for the employees, staying the remaining sexual-harassment and retaliation claims.

Jurisdiction. On appeal, the Third Circuit first found the district court properly certified its ruling under Rule 54(b), giving it jurisdiction over that final judgment.

CFAA claims. As to its CFAA claims against the employees, NRA argued they exceeded their authorization to access its system and did so without authorization at all. Agreeing with the district court’s conclusion that they did neither, the Third Circuit cited the Supreme Court’s 2021 Van Buren v. United States decision in which it found that a police sergeant did not exceed his authorized access to a law-enforcement computer database when he accessed it, after taking a bribe, to search for information about a person the briber wanted to find.

According to the Supreme Court, “an individual ‘exceeds authorized access’ when he accesses a computer with authorization but then obtains information located in particular areas of the computer—such as files, folders, or databases—that are off limits to him” and the officer had authorization to use the police database and retrieve license-plate information. The Court explained its interpretation based on “a gates up-or-down inquiry—one either can or cannot access a computer system, and one either can or cannot access certain areas within the system,” as some areas are fully “off limits.”

Access. Applying Van Buren here, the appeals court noted that the manager violated the company’s policies when she created the password spreadsheet, accessed her computer through her coworker while home on COVID leave, and asked the coworker to email the spreadsheet to her. Her coworker violated its polices when she logged in with the manager’s credentials and emailed the spreadsheet. As employees, however, they had access to the systems—the manager by the fact of her employment and the coworker with the manager’s credentials—and neither hacked anything by deploying code to enter a part of NRA’s systems to which they had no access.

Noting that the district court relied on Teva Phamrs, USA, Inc. v. Sandhu, a 2018 district court opinion explaining that “an employee is ‘authorized to access a computer when his employer approves or sanctions his admission to that computer,” the appeals court, adopting that definition, observed that NRA authorized the employees to access its computers when it hired them.

Gates were up. As to NRA’s assertion that the manager could not access her computer from home and was hacking by inducing her coworker to access her work computer, the court acknowledged that company policy prohibited her from doing so at home and both employees contravened its computer policies. But they had access to the system. “Once more, in the terms of Van Buren,” said the court, the gates were up, even if the road signs—the NRA policies—all told the women to stop and turn around.”

Breathtaking. Observing that the policy implications of the employer’s arguments were “breathtaking,” the court pointed out that the manager, while at home with COVID, needed a password to complete an urgent work assignment that she was told had to be done that day. Because she could not retrieve the necessary password, she asked her coworker to log in to NRA’s systems with her credentials and email the spreadsheet. “NRA asks us to make this a federal crime. We refuse. Instead, we affirm the District Court’s rejection of NRA’s claims that the employees ‘exceed[ed] authorized access.’”

Authorized. The court next found the employees were authorized to access the NRA’s systems. Rejecting the company’s argument that the firewalls, VPNs, and other protections blocked the manager from accessing its system while she was home, and thus she had no authorization to do so, and that the coworker was not authorized to access her files, the court instead held that “absent evidence of code-based hacking, the CFAA does not countenance claims premised on a breach of workplace computer-use policies by current employees.” Like its sister circuits, the court was “unwilling to contravene Congress’s intent by transforming a statute meant to target hackers into a vehicle for imputing liability to workers who... disregard a use policy.” Accordingly, the court affirmed summary judgment to the employees on the employer’s CFAA claims.

Trade secrets. Turning to the employer’s trade secrets claims, the court found the manager’s passwords did not have “independent economic value” and were not trade secrets under either federal or state law. The court noted that the manager’s spreadsheet contained passwords for dozens of NRA systems and third-party accounts and many databases accessible through those accounts contained consumer PII and other private information. But while the spreadsheet was a compilation of data, it was not a “compilation of customer data” or some other “intellectual property of the owner.”

“Although passwords may ‘have economic value’ if ‘integral to accessing [proprietary information], they have no independent economic value in the way a formula or a customer list might have,” the court explained, and when “a plaintiff has not alleged that its passwords are the product of any special formula or algorithm that it developed, the passwords are not trade secrets.” And here, NRA did not allege that the passwords were the product of any special formula or algorithm. Rather, the passwords were a series of numbers and letters that blocked the proprietary information that did have independent economic value: NRA’s business records and customer databases.

Civil conspiracy. As to NRA’s claim the employees conspired to violate various federal and state statutes, the court found that even if they conspired, there was no object of that conspiracy. NRA alleged violations of the CFAA, DTSA, and PUTSA as the causes of action underlying its civil-conspiracy claim but because the court found they did not violate those statutes, the “conspiracy claim failed at the threshold.”

Duty of loyalty. NRA also argued that the manager’s creation of the password spreadsheet and the coworker’s assistance in emailing it combined to show they violated their duty of loyalty, which required them to act in the company’s best interest. But here, said the court, the employer could not prove they did not act for its benefit as there was no evidence they used the information in any way other than to resolve the licensing issue.

Fraud. Finally, as to the employer’s contention the manager committed fraud by moving accounts into the compliance workgroup, entitling her to bonus payments that it did not believe she earned, the court found she did not possess the required knowledge that she was deceiving or defrauding NRA. To the contrary, there was evidence that different rules applied to her as head of compliance and that she thought she was following them and the employer’s evidence at best required the court to speculate about her intent to deceive.

The case is No. 24-1123.

Judge: Ambro, T.

Attorneys: Ivo J. Becica (Obermayer Rebmann Maxwell & Hippel) for NRA Group, LLC. Cory A. Iannacone (Pillar Aught) for Nicole Durenleau and Jamie Badaczewski.

Companies: NRA Group, LLC

MainStory: TopStory ComputerFraudPrivacy SexualHarassment Discharge TortClaims StateLawClaims Procedure TradeSecrets DelawareNews NewJerseyNews PennsylvaniaNews GCNNews