Password Sharing Can Be Criminal

A former employee who hacked his old company using another worker’s password can be charged under the 1986 Computer Fraud and Abuse Act, a three-judge panel of the Ninth Circuit Appeals Court has ruled. The court found that David Nosal violated the act when he used another worker’s password to access Korn/Ferry information, then used that information to start a rival recruiting firm. Nosal’s own log-in credentials had been revoked. However, the dissenting judge in the case said it might set a troubling precedent. “People frequently share their passwords, notwithstanding the fact that websites and employers have policies prohibiting it,” wrote Judge Stephen Reinhardt. “In my view, the Computer Fraud and Abuse Act does not make the millions of people who engage in this ubiquitous, useful, and generally harmless conduct into unwitting federal criminals.”