LVRC Holdings LLC v. Brekka
Filed September 15, 2009
Cite as 07-17116

No Violation of CFAA

Stuart Smith (Smith) was the owner and operator of LVRC Holdings, LLC (LVRC). LVRC, in turn, was the operator of Fountain Ridge, a residential treatment for persons with addictions in Nevada. As one of its marketing strategies, LVRC retained LOAD Inc. (LOAD) to provide facilities for email, website and related services.

LOAD monitored internet traffic to LVRC’s website and gathered statistics about it. LVRC hired Christopher Brekka (Brekka) to oversee a number of aspects of the facility such as conducting marketing programs and interacting with LOAD.

Brekka and LVRC did not have a written employment agreement. There was no employee guidelines promulgated by LVRC to prohibit its employees from emailing LVRC documents to personal computers.

When Brekka was hired, he was already the operator and owner of two consulting businesses, Employee Business Solutions, Inc., a Nevada corporation (EBSN), and Employee Business Solutions, Inc., a Florida corporation (EBSF). These businesses obtained referrals for addiction rehabilitation services of potential patients through the use of internet sites and advertisements.

Although, Smith was aware of Brekka’s businesses, he claimed that he was not fully aware of its operations.

Brekka was assigned a computer at LVRC. However, he sometimes used his personal computer to email documents he obtained or created in connection with his work for LVRC.

Eventually, Brekka and LVRC discussed about a potential purchase by former of ownership interest with the latter. In connection with this, Brekka emailed a number of LVRC documents to his personal email account and his wife’s personal account consisting of financial statements, marketing budget and admissions reports for patients.

When talks about his ownership interest failed, Brekka ceased to work for LVRC. He left his LVRC computer at the company without deleting any emails including his administrative user name and password.

While performing routine monitoring, LOAD was able to detect that someone was illegally gaining access to LVRC website using Brekka’s user name and password. Consequently, Brekka’s account was de-activated and LVRC filed a report with the FBI.

LVRC then filed a case in federal court alleging that Brekka violated the Computer Fraud and Abuse Act (CFAA) by accessing LVRC’s computer “without authorization”.

Brekka moved for a summary judgment. The district court, in granting the summary judgment, ruled that Brekka was authorized to use LVRC’s computers because at that time he was still employed. Moreover, the court found that LVRC failed to establish the existence of a genuine issue of material fact regarding Brekka’s access to LVRC website even after he left the company.

The United States Court of Appeals, Ninth Circuit, affirmed the ruling of the district court by finding that e-mailing the subject documents did not "exceed authorized access" where Brekka was entitled to obtain them.

Moreover, LVRC failed to establish the existence of a genuine issue of material fact as to whether Brekka’s accessed LVRC’s website was made without authority. This is because Brekka provided undisputed evidence that he left login materials on computer to which others had access and which others actually used.

Further, LVRC's witness stated that he did not know where person logging in from outside was located. Further, expert evidence that LVRC logged in to site was contradicted by testimony that LVRC’s login data was deactivated almost one year earlier.