TechFite Case Study: Cybercrime Law and Corporate Liability

Introduction and Applicable Law

The Computer Fraud and Abuse Act (CFAA) of 1986 (most recently amended in 2008) makes it a criminal offense to access a protected computer either without authorization or in excess of one's authorized access (US Department of Justice, 2022). For a claim of access without authorization to be valid, the individual must be aware of the facts that make such access unauthorized and must have accessed the computer without the authorization of an entity or person empowered to grant such access (US Department of Justice, 2022). For individuals with authorized access, the CFAA imposes limits on that access, making it illegal to knowingly access areas in a protected computer—including databases, user accounts, folders, and files—to which one's access does not extend (US Department of Justice, 2022). Under the CFAA, the investigating team will examine the division's networks and computer systems and evaluate the mechanisms in place to prevent employees from gaining unauthorized or excess access into protected computers. The division may be criminally liable if the investigation finds evidence of breaches that allowed employees to gain unauthorized access into the protected computers of other companies.

The Electronic Communications Privacy Act (ECPA) prohibits individuals from accessing, without proper authorization, electronic communications in the form of data, telephone conversations, or email while such communication is in transit, stored in a computer, or being made (Bureau of Justice Assistance, n.d.). The business intelligence (BI) unit may be criminally liable under the ECPA if there is evidence indicating that the division maintained surveillance over the emails of other companies with the aim of gathering intelligence.

Besides the risk of criminal liability as provided in statute, it is also prudent to assess the company's risk of legal action based on the tort of negligence. Investigators could make use of several laws and court cases in justifying legal action based on negligence from the information provided in the case study. In Raleigh v. Performance Plumbing and Heating, 130 P.3d 1011, 1015 (Colo. 2006), the court held that for a negligence claim to succeed, the plaintiff must prove four elements of negligence by a preponderance of the evidence and establish the extent of their damages. The court identified the four elements as: duty, causation, breach, and damages (Scordato, 2022). The defendant must owe a legal duty of care to the plaintiff (duty), which they failed to fulfill (breach), thereby causing (causation) harm or injury to the plaintiff (damages).

The California Supreme Court, in Brown v. USA Taekwondo (2021), set a standard that courts could use to determine whether a defendant owes a duty of care to a plaintiff. In the court's view, the plaintiff must prove that the parties share a special relationship that gives rise to a reasonable duty of care and that the defendant's failure to act reasonably resulted in a foreseeable injury (Scordato, 2022). The foreseeability requirement is satisfied if the plaintiff can demonstrate that the possibility of danger resulting from the defendant's actions was apparent and reasonably foreseeable (Scordato, 2022).

In determining whether a breach of duty occurred, Judge Learned Hand, in United States v. Carroll Towing, 160 F.2d 482 (2d Cir. 1947), established the Hand formula, which assesses whether a breach exists by weighing the burden of precaution against the probability and magnitude of potential harm. Besides showing that a defendant owes a duty of care, the plaintiff must show a cause-in-fact relationship between the defendant's conduct and the harm suffered (Scordato, 2022). In City of St. Louis v. Benjamin Moore & Co., 226 S.W.3d 110, 113 (Mo. 2007), the court established the but-for test of causation, which requires the plaintiff to prove that, were it not for the defendant's actions, the plaintiff would not have suffered harm or loss (Scordato, 2022).

Based on the above court cases, the TechFite case study reveals several instances where the duty of care may have been breached. According to Brown v. USA Taekwondo (2021), the duty of care is breached when an individual fails to adhere to expected reasonable care standards, resulting in harm to another person. The IT division breached its duty of care by creating accounts solely on one employee's request and failing to monitor activity or close down accounts once the employees to whom they were assigned left the company. This allowed other employees to use those accounts and their associated emails for illegal intelligence-gathering that eventually caused harm to the affected companies. The IT security analyst also violated the duty of care by failing to audit the division's client list regularly. This failure made it possible for the division head to onboard and trade with illegitimate and non-existent companies, which were used to move money and inflate the division's sales figures.

By inflating its sales revenues, the division may be in violation of the Sarbanes-Oxley Act of 2002. The Sarbanes-Oxley Act seeks to enhance public disclosure and the integrity of financial reporting mechanisms in public companies (Legal Information Institute, n.d.). Section 301 of the Act makes it a crime for an officer to willfully and knowingly misrepresent financial statements. Attempts to inflate the division's sales figures using fictitious accounts may therefore constitute criminal activity under Section 301. Further, Section 404 of the Act imposes upon the management of public companies the responsibility to establish proper internal controls and to conduct annual assessments of those control systems (Legal Information Institute, n.d.). The investigation reveals fundamental gaps—such as the inadequate segregation of duties—that may indicate a failure by management to maintain oversight as required under Section 404.

Criminal Liability Under the CFAA and ECPA

Evidence from the case study points to potential criminal activity at the applications division. The BI unit of the Applications Division violates the authorized-access provision of the CFAA by using the Metasploit tool to intentionally access the IP addresses of multiple internet-based companies without those companies' authorization. The senior analyst and two additional analysts are criminally liable for illegally penetrating the IP addresses of different companies to gather intelligence. Their actions violate the CFAA's prohibition on willfully gaining unauthorized access into protected computers. The victims include the internet companies whose IP addresses were penetrated, among them Orange Leaf Software LLC and Union City Electronic Ventures.

Through their actions, the employees managed to gather crucial proprietary information from their victims, which was then shared with competitors to the detriment of those companies. The lack of a methodology to keep clients' information segregated made it possible for proprietary and sensitive information belonging to previous, potential, and existing clients to leak. The division also failed to enforce separation of duties and the principle of least privilege, granting full administrative rights to each workstation and computer. This created an environment in which employees could easily access proprietary information about client companies.