Insiders who have valid credentials to access confidential info cannot be charged under US anti-hacking law

A ruling handed up this week in a US appeals court found staff who violate their organisation’s user policies do not violate the federal Computer Fraud and Abuse Act (CFAA).

David Kosal, a former manager at executive search firm Korn/Ferry, beat charges that he convinced three of his former co-workers to use their valid login credentials to access and download customer lists and then transfer them to him so he could start a competing company.