Legal Question in Business Law in Georgia

These are VERY serious allegations-- not only does it expose these individuals to civil liability, but also to potential criminal liability. Such liabilities extend range potential civil torts such as invasion of privacy and tortuous interference with a business contract to criminal violations such as breaking federal wiretapping laws and Georgia computer privacy laws.

Depending on the strength of your evidence, I would launch both a criminal complaint as well as a civil complaint. Nonetheless, it may be best if you speak to and retain a local civil litigation attorney prior to filing a complaint with any law enforcement officials. In the best case scenario, an attorney may be able to "piggy back" off any potential criminal prosecution to seek criminal damages.

The seriousness is primarily your call. Assuming they have taken the information, what is the damage to your company. Beyond that, you need to see a litigation lawyer as soon as possible. That means this week. In order to stop them from using the information immediately, the law requires that you act promptly -- usually within days of the discovery. Otherwise, you might still have your claim but your remedy is money damages after a trial. The key is stopping them now. That usually leads to a prompt resolution.

To answer your questions directly:

1. What laws have these individuals and the company they are involved with violated?

If your allegations are true, then there are violations of both federal and state law.

The federal Computer Fraud and Abuse Act (18 USC 1030 et seq.) protects computers that are used in or that affect interstate commerce. This extends the scope of the Act to the full extent allowed by the US Constitution. Your computer is connected to the Internet and is protected by this Act.

Some possible federal violations under CFAA include (a) Intentionally accessing a computer without authorization to obtain information, and (b) Knowingly accessing a protected computer (such as yours) with the intent to defraud and to obtain anything of value. There is no requirement that you must show, in order to establish a violation, a monetary loss; the intent to cause a general harm will suffice.

There may be other violations, such as "hacking" (knowing transmission of a program such as a worm or virus) but you haven't (as yet) raised any such allegations.

The conduct would also violate the Georgia Computer Systems Protection Act (Ga. Code 16-9-90 et seq), a state law that is parallel to the federal law. Section 93 defines a "computer theft" as using a computer or network with knowledge that such use is without authority and with the intention of (1) Taking property of another (and it need not involve depriving the owner of possession or (2) Obtaining property by any deceitful means or artful practice.

It also defines other possible violations, such as Computer Password Disclosure. A person who discloses a password, knowing that such disclosure is without authority and which results in damages (including the fair market value of any services used and victim expenditure) over $500.00 commits the crime of computer password disclosure.

Georgia law also makes the theft of trade secrets a crime. (Such a theft could occur via computer fraud, so both the fraud and the trade secret theft would be violations). While "trade secrets" is legally defined, so that not all "confidential information" is a trade secret, there is certainly a strong possibility that trade secrets may have been stolen.

2. How serious are these violations?

Very. The Congress has increased the penalties for violation of the federal CFAA to ten (10) years incarceration maximum. Criminal penalties for violation of the state CSPA include fines of up to $50,000 and incarceration of up to 15 years.

3. What do I need to legally go after them?

Two things, mainly: (a) Evidence and (b) a lawyer. You have made a good start in collecting evidence. You can improve on this by starting a journal, reciting, by date and (if possible) time of relevant events. You want to include names and addresses of likely violators as well. The questions you want to answer include, but aren't limited to: When did you discover this? How? What email accounts were hacked? When? What information was taken (if you can tell)? What information is available to be taken? What is the value of this information to the company?

Please don't, however, go around sharing the information with other than the FBI, GBI or your counsel. That could create liability against you.

As far as "going after them" you need to recognize that you will have both civil and criminal remedies. Remember, you aren't the master of the criminal remedy: that is for the District Attorney. You can file a civil suit, however. In some cases you might want to send a letter to the violators before filing a lawsuit; this decision should be reached with an attorney.

I've had several similar cases such as this and can tell you that there are many strategic decisions to be made. If you want to call or email me, please feel free to do so.