1. Access Permission May End before an Account Is Disabled
The first question is whether the employer permitted a particular connection when it occurred. An active account only shows that the system has not blocked the connection. Separation, suspension, or post-employment consulting arrangements can change the answer even when the login process stays the same.
Permission Changes during and after Employment
A worker may access a database for an assigned project on Monday but lose permission on Tuesday. Termination letters, suspension notices, and messages from authorized managers help establish the transition. A written consulting arrangement may instead permit limited work after separation.
Employment and authorized access may end on different dates. IT staff may disable credentials after termination, but that delay does not extend permission. What matters is what the employer allowed during the disputed activity.
Working Passwords and Shared Accounts
Records may show who issued a password, what restrictions applied, and whether the employee received notice of revocation. A coworker sharing credentials does not necessarily restore access an employer withdrew.
Those distinctions matter in computer fraud allegations. A successful login establishes a connection, not permission or the elements of an offense.
2. State and Federal Computer Access Laws Require Separate Analysis
One allegation of unauthorized access may implicate California Penal Code § 502, the federal CFAA, or both. Their elements differ. Separate system entry from copying data or using information for an improper purpose.
California Penal Code Section 502 and Lawful Employment
Section 502(c)(7) covers knowing access to a computer or network without permission. Section 502(c)(2) separately addresses knowing access followed by taking, copying, or using data without permission. A disputed login and an alleged export therefore call for different evidence, even when they occurred in one session.
Section 502(h)(1) exempts acts within lawful employment when reasonably necessary for a work assignment. Narrower exceptions address certain employee uses of computer services. Neither a job title nor an active account alone establishes an exception.
Federal CFAA Limits on Authorized Access
Under 18 U.S.C. § 1030(a)(2), prosecutors must establish intentional access without authorization or beyond authorized access, resulting in the acquisition of covered information. Other subsections have additional requirements, including fraudulent intent or damage. The CFAA framework should therefore be assessed against the specific allegation.
In Van Buren v. United States (2021), the Supreme Court held that an improper purpose does not itself constitute exceeding authorized access when the information was otherwise accessible. In United States v. Nosal (9th Cir. 2016), the court upheld CFAA convictions involving the use of a current employee's credentials after the defendants' access had been affirmatively revoked. The distinction is between misuse of permitted access and entry after permission has ended.
3. Digital Evidence Can Clarify the Access Timeline
A cybercrime investigation may begin with a login alert or unusual download. Neither establishes permission on its own. Digital evidence gains meaning when matched to the employer's instructions and account changes.
Login Logs, Devices, and Permission Histories
Authentication records may identify accounts, times, IP addresses, and devices. File logs reveal downloads or edits; administrator records show suspensions or permission changes. Together they help establish whether activity preceded or followed revocation.
Time zones, shared accounts, remote sessions, and automated synchronization can complicate attribution. A recorded account name does not necessarily identify the person who used it. These questions may require examination of authenticity and collection methods, as discussed in digital evidence challenges.
Company Policies and Revocation Communications
Employment contracts may impose confidentiality duties; IT policies limit account use. Compare both with assignments, transition approval, and revocation notices. A general ban on personal use differs from a clear instruction not to enter a database.
Under the CFAA, violating a use policy does not automatically mean exceeding authorized access. Under § 502, the charged subsection's permission requirements and employment exceptions need independent review. A breach of contract or confidentiality duty may raise separate issues without proving a computer-access offense.
4. Investigation Responses Should Preserve Records and Limit New Risks
Internal inquiries, civil demands, and criminal investigations require different responses. Preserve existing records without returning to company systems. Consider the nature of each request and the lawful source of the records.
Preserving Records without Reentering Company Systems
Preserve lawfully held termination notices, transition instructions, and messages. Prepare a chronology without editing original records. Do not delete communications, wipe devices, change logs, or ask coworkers to retrieve restricted files. Preservation does not authorize new system access.
Some evidence may need to be obtained through counsel or formal legal process. A qualified forensic examiner can evaluate preserved records and explain technical discrepancies without altering the company's systems.
Legal Review of Allegations and Investigative Requests
A cyber crime attorney can review the charged statutory elements, identify when permission was allegedly withdrawn, and assess whether records reliably connect a person to the activity. Counsel may also distinguish criminal allegations from civil claims involving contracts, confidentiality, or trade secrets. The broader cybercrime practice overview addresses other categories of digital misconduct.
Before answering an interview request or document demand, determine what it requires and consider legal advice about the response. An allegation is not a finding of guilt. The central question is whether evidence establishes prohibited conduct under the particular law invoked.
29 Oct, 2026
