3rd Circuit Clarifies Scope of Computer Fraud Abuse Act With Employer’s Policies

The Third Circuit this week clarified that an employee’s alleged breaches of workplace computer-use policies cannot be criminalised under the Computer Fraud and Abuse Act (CFAA) if there is no evidence of hacking or violations of trade secrets, according to the court’s decision.

On 29 August 2025, the appellate court affirmed the Middle District of Pennsylvania’s ruling that Nicole Durenleau and Jamie Badaczewski did not violate the CFAA by breaching their employer National Recovery Agency Group’s computer policies. The court held that the employees were authorised to access National Recovery’s systems as employees, despite the alleged sharing of passwords to access a work computer while one employee was out sick. Judge Thomas L.

Ambro, joined by Judges Thomas Hardiman and Theodore McKee, described CFAA as the wrong tool for NRA’s project and suggested other causes of action such as breach of contract or negligence could remedy employers’ grievances. Read more at Law[.]com, according to Law[.]com.