Posted: August 19, 2015

Second Circuit Examines Accrual of Claims for Unauthorized Computer Access

On August 4, 2015, the Second Circuit issued a decision in Sewell v. Bernardin, Docket No. 14‐3143, “address[ing] a matter of first impression in” the Second “Circuit: the operation of the statutes of limitations applicable under the civil enforcement provisions of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, and the Stored Communications Act (“SCA”), 18 U.S.C. § 2701, et seq.”

In Sewell, the plaintiff sued the defendant, “her former boyfriend” in the EDNY for violating the CFAA and SCA by accessing her “e‐mail and Facebook accounts without her permission.” The EDNY found that both claims were time-barred. The Second Circuit affirmed with respect to the claims relating to access to the plaintiff’s email account because she:

discovered the “damage” to her AOL account for CFAA purposes on August 1, 2011, when she learned that she could not log into her AOL e‐mail account.  That she may not have known exactly what happened or why she could not log in is of no moment.  The CFAAʹs statute of limitations began to run when [the plaintiff] learned that the integrity of her account had been impaired.

(Internal quotations and citations omitted) (emphasis added). On the other hand, the Second Circuit held that the EDNY had erred in holding that the plaintiff’s claims regarding her Facebook account were time-barred, explaining:

[The plaintiff’s] Facebook‐related claims, by contrast, appear to have accrued on or about February 24, 2012.  Her complaint alleges that she was the sole authorized user of her Facebook account. On or about February 24, 2012, she discovered that she could no longer log into or access her account with because her password had been altered. There is nothing in the facts as alleged in the complaint from which to infer that anyone gained unauthorized access to her Facebook account before then.  Thus, taking these allegations as true, there would have been no damage, for CFAA purposes, or violation, for SCA purposes, for [the plaintiff] to discover with respect to her Facebook account before that date, which was less than two years before the suit was brought.

(Internal quotations and citations omitted).

View posts