December 19, 2025

By: Mark T. Sottile , Joshua D. Hill

Here is yet another reason why employers should have written policies, including with respect to employees who separate from employment, whether through resignation or termination. In a case of first impression under the Computer Fraud and Abuse Act ( “CFAA”), the Third Circuit vacated a CFAA conviction and held that an employee’s resignation alone does not automatically terminate the employer’s authorization to access company computer systems under the CFAA, absent a prior agreement or affirmative act by the employer rescinding that authorization. United States v. Eddings (2025 WL 3523079).

After the working relationship deteriorated between  the Prostate Cancer Foundation (“PCF”) and a short-term employee with authorized access to a board member’s email account, the employee sent an email declining to continue the work and sought payment. PCF stopped communicating with her but did not disable her access to the email account for several weeks. During that  period, the employee accessed emails and internal documents and shared them with a friend.  They later threatened to release the documents unless payment demands were met. Both were charged and convicted under the CFAA for intentionally accessing a protected computer “without authorization.”  The  employee and her friend were convicted and  the latter appealed.

At trial, the Government argued that the employee’s resignation itself terminated authorization, rendering all post-resignation access criminal. The Third Circuit disagreed, holding that “authorization” depends on the employer’s actions, not the employee’s unilateral conduct. Once an employer grants access, authorization continues unless and until the employer affirmatively rescinds it, such as by disabling credentials, issuing a revocation notice, or acting pursuant to a contractual or policy-based limitation. The Court emphasized that resignation is the act of the employee, not the employer, and therefore cannot by itself revoke previously granted authorization.

The Third Circuit expressly limited its holding to a resignation, noting that it has not decided whether authorization is revoked when an employee is fired, since termination is an affirmative act by the employer. The Court also did not foreclose revocation by contract, employee handbook, or other advance policy tying authorization to employment status, nor did it prescribe any specific method by which employers must revoke authorization.

The lesson for employers is clear – whether an employee leaves voluntarily or is fired, the employer should revoke access immediately and confirm – in writing – to the employee that their access has been revoked, thus rendering any further access by that employee illegal. It would also be prudent, lest this written directive is not communicated, for the employer to have a handbook policy confirming that e-mail access is revoked immediately upon separation, whether through resignation or termination.