Restrictive Covenants Tied to Compensation, Quirky Question # 96
Our feeling is that if we want to waive the non-compete for certain employees, as well as our payment obligations, we’ll be able to do so. Moreover, we are planning to insist that the employees provide us monthly written reports of their efforts to find other jobs, detailing precisely what was done in the preceding month to find employment. To the extent the employees fail to submit such a report in a particular month, or submit a report that in our discretion is inadequate, the company will be relieved of its obligation to provide the compensation. Frankly, we feel this will provide us sufficient flexibility to withhold payment. Make sense?
Roy’s Analysis:
If, for example, your employees work in California or North Dakota, your non-competition agreements will be unenforceable, except in extremely limited circumstances. Both the legislatures and courts in these jurisdictions have repudiated non-competition agreements. In short, when crafting your company’s non-competition agreements, you need to be acutely aware of the relevant state law.
Lastly, I am somewhat uneasy by the undercurrent of your question. You observe that if the employees do not submit reports on a monthly basis, or submit reports that the company, in its discretion, does not deem adequate, you will have “sufficient flexibility to withhold payment.” I don’t want to read too much into your observation but it sounds as though your company may be considering offering this benefit without really planning to provide your ex-employees with the compensation promised to make the restrictive covenants “more palatable.” If so, that would be a mistake.
If you are going to enter a contract with your employees that includes restrictive covenants, and if you are going to offer substantial compensation to your employees to induce their agreement, your expectation should be that your company will fulfill its contractual obligations. My admonition can be illustrated by a recent case from the Eighth Circuit Court of Appeals, Bannister v. Bemis Company, No.08-1634 (February 25, 2009). The District Court (Judge Kyle from the District of Minnesota, applying Arkansas law due to a choice of law provision), granted summary judgment to the employee, awarding him $81,051 based on the defendant company’s breach of its monthly payment obligations, as set forth in the non-competition agreement. Despite the de novo standard of review (that is, the appellate court did not defer to the lower court’s determination), the appellate court affirmed.
In Bannister, the non-compete prevented the employee from working for a competitor for 18 months following the termination of employment. If the employee was “unable to obtain employment consistent with his abilities and education solely because of the [non-compete] . . . [the non-compete would continue to bind the employee] only as long as Bemis, in its sole discretion made payments to him equal to his monthly base salary at the time of his termination.” Bannister requested his employer to release him from the non-compete so he could obtain employment with a Bemis competitor, but Bemis rejected this request. Approximately nine months later, Bemis terminated Bannister’s employment, offering a severance package and a release from the non-compete, except as to the competitor Bannister previously sought to join. Bannister declined the company’s offer.
The court also examined the issue of whether Bannister’s failure to submit monthly statements regarding his efforts to find alternative employment (like the obligation your company is considering) justified the company’s refusal to pay the compensation required in the contract. Because Bannister had provided documentation regarding the job offer he had received from Bemis’s competitor, and because Bemis breached its obligations by refusing to pay the required funds, the court found that Bannister did not need to submit the monthly statements that otherwise would have been required. As the court stated, “the failure of one party to perform its contractual obligations releases the other party from its obligations. The party who first breaches a contract is no position to take advantage of a later breach by the other party.” (Citations omitted.) In sum, both the federal District Court and the Court of Appeals found that the employer was obligated to fulfill its obligation to pay its former employer his base salary as set forth in the non-compete agreement drafted by the company.
If your company elects to include a payment obligation in your restrictive covenants (which, as discussed above, your firm does not need to do), be prepared to fulfill your obligations to your former employees. Failure to do so would expose your company to risks of of litigation and liability.
Stealing Confidential Information, Quirky Question # 78
Quirky Question # 78:
I am the HR Director at our company. I just learned that one of our most valuable employees has resigned and taken a position with a competitor. I requested our IT Department to make an evaluation of his computer. They reported to me that before he left, he emailed to himself and his new employer customer and rate information We consider that information to be highly sensitive, potentially providing our ex-employee the chance to divert a significant portion of our business to his new employer.
Most of our employees have non-competition agreements but, as it turns out, the employee who just quit never signed one. I also doubt that we could claim the data he took is trade secret. Unfortunately, we have not taken reasonable steps to protect the confidentiality of this information. Are we out of luck?
[Readers: The question below was posed to my partner, Nick Akerman, who works in Dorsey's New York office. Nick, an expert on the Computer Fraud and Abuse Act, provides the following analysis. If you would like to communicate with Nick, don't hesitate to contact him at 212.415.9217 or akerman.nick@dorsey.com. More information about Nick is available on our firm's Website; see http://www.dorsey.com/akerman_nick/. Regards, Roy]
Nick’s Analysis:
As you recognize, your company’s position would be enhanced either if: a) your employee had executed an agreement containing post-employment restrictive covenants such as a non-compete or non-disclosure obligation, or b) your company had taken appropriate steps to protect the confidentiality of the data so that you could seek protection pursuant to the Uniform Trade Secrets Act. Despite the unavailability of potential contract or statutory claims based on these legal theories, however, you are not out of luck.
When data has been stolen, a company also has the option under the Computer Fraud and Abuse Act (“CFAA”) to file a lawsuit in federal court for injunctive relief and damages. Title 18, U.S.C.§ 1030. The injunction can direct the employee and his new employer to return the stolen data and prevent the employee and his new employer from contacting the customers who are the subject of the stolen data. In other words, you may be able to obtain the same relief as if your employee had a valid restrictive covenant requiring him not to conduct business with your customers.
Primarily a criminal statute, the CFAA provides that “[a]ny person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief.” § 1030(g). Because it is a federal statute, you can file in federal court. (State causes of action for theft of trade secrets and breach of a restrictive covenant cannot be filed in federal court unless there is diversity of citizenship or there are other federal claims.)
The CFAA was enacted in 1984 as a criminal statute to criminalize the theft of national security and banking data. In 1992 it was amended to include the ability for an individual injured by a violation of the statute to bring a civil action, much like the Racketeer Influenced and Corrupt Organizations (“RICO”) statute, Title 18, U.S.C. § 1961, et seq. The CFAA has since been amended a number of times to keep up with new technologies and the ubiquity of computers in society. The CFAA was last amended in 2001 in the U. S. Patriot Act to include computers located outside the United States if they communicate with the United States or are involved in commerce with the United States.
The CFAA outlaws the entire panoply of computer crime including stealing computer data. There is no need to show that the data is trade secret protected, copyrighted, confidential or proprietary. Rather, one of the key elements necessary to prove a CFAA civil action, as explained in more detail below, is to show that the employee accessed the company computer without authorization or exceeded the authorization he had been granted.
As a jurisdictional prerequisite to filing a civil CFAA action, the plaintiff company must allege and ultimately prove $5,000 in loss. “Loss” is defined by the CFAA as
“any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.”
The “federal courts have sustained actions based on allegations of costs to investigate and take remedial steps in response to a defendant’s misappropriation of data.” Modis, Inc. v. Bardelli, 531 F. Supp. 2d 314, 320 (D. Conn. Jan. 22, 2008). Such costs must of course relate to the computer. In Nexans Wires, SA 319 F.Supp. 2d 468, (S.D.N.Y 2004), aff’d, 166 Fed. Appx. 559, 562-63 (2d Cir. 2006), for example, the court held that $8,000 spent by two corporate executives to fly to Manhattan from Germany to examine the computer intrusion and discuss the breach at the French restaurant Le Cirque did not qualify for the $5,000 loss because the expense was not sufficiently related to the company computer.
The CFAA encompasses what it defines as a “protected computer.” The CFAA’s definition of protected computer, however, covers every conceivable type of computer. § 1030(e)(1). As the defendant rightly claimed in United States v. Mitra, 405 F. 3d 492, 495 (8th Cir. 2005), “[e]very cell phone and cell tower is a ‘computer’ under this statute’s definition; so is every iPod, every wireless base station in the corner coffee shop, and many another gadget.”
Four of the seven causes of action under this statute require proof that the person who accessed the computer did so “without authorization or exceeding authorization.” Title 18, U.S.C., §§ 1030(a)(2), (a)(4), 5(A)(ii), and 5(A)(iii). The courts have acknowledged that the difference between unauthorized access and exceeding authorized access is “paper thin.” Inter’al Airport Centers, LLC v. Citrin, 440 F.3d 418, 420 (2006). For example, in the employee/employer context an employee is authorized to access the company computers to perform work for the company but exceeds that authorization when the computer is accessed to steal data for a competitor. Lack of authorization, as interpreted by the courts, can be established in four separate ways.
First, lack of authorization can be shown when an employee violates his agency relationship with his employer by accessing the employer’s computer for a purpose that is contrary to the interests of the employer. It is the breach of the “duty of loyalty” that terminates “the agency relationship “and with it” the “authority to access” the computer. Citrin, 440 F.3d at 420-21. In Citrin, the defendant employee Citrin used an erasure program to destroy data on his employer’s computer immediately prior to his resignation from the company to join a competitor. Thus, the court found that Citrin’s authorization to access the computer terminated when he “resolved to destroy files that incriminated himself and other files that were also the property of his employer.” Citrin, 440 F.3d at 420.
The agency theory upon which authorization is based is not universally accepted by the lower courts. There are at least five reported federal district court decisions that have refused to adopt the agency standard as a predicate to an employee’s authorization to use an employer’s computers. These district courts take the simplistic view that if the employee was authorized to use the employer’s computer, he was authorized to use if for all purposes. Thus, even if the employee accessed the computer to steal the employer’s data, the employee did not violate the CFAA because the employee, as part of his duties, was authorized to access the computer.
For that reason, these courts ruled that the intent of the employee in accessing the computer was irrelevant to the question of authorization and that “the phrase ‘without authorization’ generally only reaches conduct by outsiders who do not have permission to access the plaintiff’s computer in the first place.” Shamrock Foods Co. v. Gast, 535 F.Supp.2d 962, 964-65 (D. Ariz. 2008); Diamond Power Intern., Inc. v. Davidson, Nos. 1:04-CV-0091-RWS-CCH and 1:04-CV-1708-RWS-CCH, 2007 WL 2904119, at *13 (N.D. Ga. Oct. 1, 2007); Brett Senior & Assocs., P.C. v. Fitzgerald, No. 06-1412, 2007 WL 2043377, at *2-4 (E.D. Pa. July 13, 2007); Lockheed Martin Corp. v. Speed, No 6:05-CV-1580-ORL-31, 2006 WL 2683058, at *5 (M.D. Fl. Aug. 1, 2006); Int’l Ass’n of Machinists and Aerospace Workers v. Werner-Masuda, 390 F.Supp.2d 479, 495 (D.Md. 2005).
None of the Circuit courts, however, have adopted this view of authorization, and this issue has not yet reached the Supreme Court. For example, the 11th Circuit in United States v. Salum, 257 Fed. Appx 225, 230 (11th Cir. 2007) upheld a criminal conviction for a violation of the CFAA, where the defendant employee was authorized to access the computer but did so for an improper purpose. In that case the court affirmed the criminal CFAA conviction of a police officer with the Montgomery Police Department, who had provided information from the FBI’s National Crime Information Center database to a private investigator. Although the defendant police officer “had authority to access the NCIC database” [just like any employee has the authority to access his company's computers] the Court held that there was sufficient evidence to convict on the element of lack of authorization because the defendant knew the information he accessed was to be used “for an improper purpose.” The court did not cite either the Diamond Power case or Lockheed Martin the two district court cases from the 11th Circuit which dismissed CFAA civil cases finding that the defendants’ motive in accessing the computers had no bearing on whether the access was authorized. Nonetheless, Salum effectively overruled these two lower court cases.
Second, the limits of authorization to access a computer can be set by agreement. In EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 583-84 (1st Cir. 2001) the court upheld a preliminary injunction entered by the district court based on a violation of the CFAA because the defendants, all former employees of the plaintiff, had accessed and downloaded pricing data on EF Cultural’s website by violating their confidentiality agreements with EF Cultural. In that case the former employees used EF Cultural’s confidential information concerning its public website to create an automatic robot to download from the website all 154,293 prices for high school tours in a two-day period.
Third, lack of authorization can be established by a violation of company rules and policies. The CFAA is a unique statute in the sense that it allows companies to set the rules that form the predicate for a violation of the statute. In EF Cultural Travel BV v. Zefer Corp., 318 F.3d 58, 63 (1st Cir. 2003), the court recognized that the “CFAA . . . is primarily a statute imposing limits on access and enhancing control by information providers.” Thus, a company “can easily spell out explicitly what is forbidden.” Id. at 63. Doe v. Dartmouth-Hitchcock Medical Center, 2001 WL 873063 *2 (D.N.H. 2001) provides a clear example of the critical nature of promulgating workplace rules for accessing data. In that case, the court interpreted “unauthorized access” based on the hospital’s Graduate Medical Training Manual which contained “policies governing the confidentiality of patient records, which generally prohibit interns and Fellows, like . . . [the Defendant] from accessing patient records absent a ‘professional ‘need to know.’” Based on these policies, the court found that the defendant, who was a resident in psychiatry at the Dartmouth hospital, “was granted only limited access to Dartmouth’s computerized patient records” and this limitation was imposed “for the very purpose of protecting patient confidentiality.” Id. at *5.
A patient whose records had been allegedly viewed by a hospital intern for reasons unrelated to treatment sued the hospital and the intern for violations of the CFAA. The court dismissed the CFAA claim against the hospital finding that it had been victimized by its “own policies.” Id. at * 5. For that reason it would be inconsistent with the purpose of the CFAA “to protect computer systems . . . from unauthorized access and concomitant damage – to find the hospital was vicariously liable for the actions of the resident.” Id.
Fourth, the courts have found that access is without authorization when it exceeds the expected norms of intended use of the computer. In United States v. Phillips, 477 F.3d 215 (5th Cir. 2007) a student at the University of Texas was provided access to a school secured network through a password consisting of his Social Security number. The student, however, used what is known as “’brute-force attack program’ which automatically transmitted to the website as many as six Social Security numbers per second, at least some of which would correspond to those of authorized . . . users.” Id. at 218. This program allowed Phillips “[o]ver a fourteen-month period” to gain “access to a mother lode of data about more than 45,000 current and prospective students, donors, and alumni.” Id. The court upheld the student’s criminal conviction under the CFAA, finding that his access to the computer was not authorized because the “brute force attack” exceeded the expected norms of intended use of the computer.
In sum, the CFAA provides your company a legitimate basis on which to seek redress for the wrongful conduct of your former employee, given that he used your company’s computers to copy critical customer and rate information, and forwarded that data to both himself and his new employer. Other claims may be available to your company as well, such as a claim for breach of fiduciary duty, or a claim based on your state’s unfair competition laws. In the future, however, you can further enhance the protections for your company by ensuring that all appropriate employees execute the agreement containing your post-employment restrictive covenants. Similarly, as you recognize, it would be prudent for your company to take appropriate measures to ensure that your company’s confidential information is treated in a manner that ensures protection under the Uniform Trade Secrets Act.
California Non-Competes, Quirky Question # 55
We have a highly mobile workforce, and we are concerned about our former employees going to work for a competitor, stealing our customers, and raiding our employees. We are a technology based company and have developed proprietary information that would give our competitors an edge if our former employees were to use or disclose it to them. We are based in California and understand that it has a very narrow view of non-competition agreements. It seems very unfair. If we put provisions into our contracts to try to stop this from happening, what are the chances that the contract will be enforceable?
If you have any particularly unusual questions pertaining to California law, you can send them either to Karen or me.]
Karen’s Analysis:
The Court of Appeal and the Supreme Court both disagreed. Citing the express language of Section 16600, the Supreme Court rejected any “rule of reasonableness” or “narrow-restraint” exception that would uphold a non-competition agreement so long as it did not completely preclude the employee from engaging in a lawful profession, trade or business. The court concluded, “Section 16600 is unambiguous, and if the Legislature intended the statute to apply only to restraints that were unreasonable or overbroad, it could have included language to that effect.” The only exceptions are those set forth in the statute itself that allow non-competes in the context of a sale or dissolution of a corporation, partnership, or limited liability corporation where the individual granting the non-compete has an equity interest in the business being sold (e.g., a shareholder or a partner).
Restrictive Covenants; Interference with Contract: Quirky Question # 11
Our firm uses non-competition agreements for a number of our key employees. The non-competition agreement was drafted by our outside counsel who tells us that it is enforceable. One of our managers who had signed such an agreement recently resigned. We just learned that she will be starting employment at our primary competitor, in a role nearly identical to that which she performed for our company. If I contact her new employer to inform it of our manager’s non-compete, and her new employer withdrew her job offer, could she sue us for interfering with her prospective employment relationship?
As a preliminary matter, you should understand that non-competition agreements, which constitute one type of “post-employment restrictive covenant,” are governed by state law. There is no federal statute dictating whether non-competes are enforceable. Rather, state law determines the enforceability of non-competes. Some states enforce them; some states enforce them but only in limited circumstances; some states largely repudiate them. In short, the first issue you need to resolve is whether the state where this dispute has arisen is one that will enforce a properly crafted non-compete.
Moreover, as the last sentence implied, even jurisdictions that recognize the validity of non-competes will evaluate whether they are crafted properly. Typically, courts will assess the substantive, geographic, and temporal scope of the non-competes when evaluating their legitimacy. There are other issues regarding non-competes upon which courts will focus but they are beyond the scope of my observations here. Essentially, however, courts attempt to balance the employer’s legitimate business interests with the employee’s needs for job mobility and income.
Although there is a legal theory for “tortious interference with contractual relations,” and although the action you are proposing could result in your former employee losing her new job, I do not believe those facts should deter you from taking the action you outline. Even if your actions resulted in a change in the new employer’s perception of your former manager, your actions would not be “tortious.”
Like non-compete law, the law of tortious interference with contractual relations is dependent upon the common law of the relevant state. Though there are differences in the various states’ approaches to this legal theory, in most jurisdictions, an element of the tort involves some type of “wrongful” conduct. Some times that conduct is described as “malicious,” other times the element is described as “acting improperly,” and in some instances the element is described somewhat circularly as “wrongful” or “tortious.” All of these formulations of the legal theory, however, encompass the notion that there has been some type of inappropriate or improper conduct or motive that caused the interference.
In the context you describe (enforceable non-compete, designed to protect your company’s legitimate interests), it is perfectly appropriate for you to notify both your ex-employee and her new employer that she would be in violation of her contractual agreements with your company were she to take a job with your competitor. Your company has the right to do so, and can take this action without undue anxiety of potential litigation. Indeed, if your company failed to take this step, your manager later might argue your company knowingly waived its right to enforce its contract with her. Such inaction could have implications not just for the specific employee who recently left your employment but for your other employees who signed identical restrictive covenants.
If you wish to insulate your company further against the risk of litigation, you may want to have the communication to your former manager and her new employer drafted and sent by counsel. Communications by counsel in anticipation of or in connection with litigation are, at a minimum, qualifiedly privileged. Many of these communications are deemed absolutely privileged. Therefore, by relying on counsel to convey this message, you reduce the already slim likelihood that your manager will ever be able to assert legitimate claims against your firm.
In addition, your manager’s new employer may well appreciate being apprised of her contractual breach. Who knows what your former manager stated to the new employer. Perhaps she represented that she had no restrictions on her employment. If so, the new employer may be quite pleased to learn, early in the employment relationship, that it had been deceived.
Moreover, if the company retains her with knowledge of her pre-existing, post-employment restrictive covenants, it may be confronting increased risks of liability it would prefer to avoid. On the other hand, the new employer may be fully cognizant of the non-compete and may have made the determination that it is willing to litigate the issue (or at least attempt to resolve the problem through negotiation) because of its interest in hiring your former manager.
As to the issue of whether your ex-employee ‘could’ sue you, my observation is simple. There is always a risk of litigation when actions taken by a company have an adverse impact upon individuals, whether current or former employees, or members of the public. It is critically important to distinguish, however, between a risk of “litigation” and a risk of “liability.” Here, although your former employee may threaten suit, or possibly even initiate litigation, based on the limited facts you described, your risks of “liability” are not significant.
That does not mean a lawsuit will be cost free. If the matter is litigated, you will incur attorneys’ fees and your management team will be distracted by the litigation. But, both the fees and the distraction may well be justified by the important principle at issue in the lawsuit – enforcing your company’s legitimate non-competition agreements. This principle may have ramifications far beyond the specific situation of your recently departed manager. For that reason, you may wish to modify your analysis from your defensive posture (do we risk litigation by our former employee?) to a more aggressive stance. Assuming you have a legitimate, enforceable non-compete, and that your employee has joined a competitor where she will be fulfilling the same job responsibilities she performed for your company, you may want to be the plaintiff and bring an action to enforce your contractual rights. Again, such litigation may have benefits that extend well beyond your dispute with your recently departed employee.
Follow
