Anyone in enterprise IT tends to witness computer use policies defied from time to time, but how often does it amount to a federal crime? According to the government's position in a pending lawsuit, violating a corporate computer use policy is equivalent to violating the federal Computer Fraud and Abuse Act. 

The issue is at the heart of a case that the government brought against a former employee of the executive search firm Korn/Ferry International, who is charged with getting current employees to access a proprietary database and pass information along to him. The current employees had permission to access the database, but not for the purpose alleged in the case. The government lost the case at the U.S. District Court for the Northern District of California and is appealing to the U.S. Court of Appeals for the Ninth Circuit.   

As the Electronic Frontier Foundation pointed out in an amicus brief filed last week with the appeals court, if the government's position were to prevail, millions of employees could be deemed criminals for doing things like checking the news online or visiting a social networking site if the company policy prohibits personal use of company computers. 

"Criminal punishment cannot be based on the vagaries of privately created, frequently unread, generally lengthy policies that may be altered without notice," EFF wrote in the brief. "In the government's view, if a company's corporate policy says that work computer systems may be used only for legitimate company business--as Korn/Ferry's agreements do--and a worker looks at the website of her son's school to see whether a blizzard has caused classes to be canceled that afternoon, she commits a computer crime."

The Electronic Frontier Foundation is taking an important stand in this case. As we all know, computer use policies are often a work in progress, particularly in this age of rapidly changing online technologies and behaviors. As EFF noted, these policies really aren't developed with the same level of thought and precision--and, I would add, time--as federal laws. While it's fair to expect employees to follow these policies, it is an overly harsh penalty, with rare exceptions, to turn violators into federal criminals. - Caron