Gates Down: Third Circuit Says Breaking Employer Computer Access Policies Is Not Hacking

According to The National Law Review, the U.S. Court of Appeals for the Third Circuit has ruled that violations of employers’ computer access policies do not amount to federal CFAA violations, and that account passwords are not company trade secrets. The decision, issued in an amended precedential form on 7 October 2025 in NRA Group LLC v.

Durenleau, adopts a “gates-up-or-down” approach to CFAA violations, finding that employees normally authorised to access company systems do not exceed authorised access simply by accessing those systems in ways or for purposes not allowed, provided they are permitted to access them.

The ruling follows an incident involving two former NRA employees; one, while out sick, asked a colleague to log into her work computer and send a spreadsheet containing her work account passwords, actions which violated the employer’s computer-use policies. NRA had sued the employees alleging CFAA, Defend Trade Secrets Act and PUTSA violations, but the district court granted summary judgment and dismissed the claims.