Vacated CFAA conviction spotlights offboarding, delegated email risks, and authorization revocation
Third Circuit says resignation does not end system authorization, vacating a CFAA conviction and urging HR to explicitly revoke access and tighten offboarding.
On December 9, 2025, the U.S. Court of Appeals for the Third Circuit vacated the Computer Fraud and Abuse Act (CFAA) conviction of Frances M. Eddings, making clear that an employee’s or contractor’s resignation does not, by itself, end their authorization to access company systems. The Court held that authorization turns on employer permission: once granted, it ends only when the employer rescinds it, or if a contract or policy expressly ties authorization to employment. The Court remanded with instructions to enter a judgment of acquittal.
The dispute arose from a 2014 fundraiser project for the Prostate Cancer Foundation (PCF). Contractor Jude Denis was given the ability to read, write, and send emails on behalf of PCF board member Neil Rodin through a link installed on her personal computer. After several days, the relationship deteriorated. On August 21, Denis emailed that she could not accept continued work and submitted an invoice for her time and expenses. PCF did not pay and ceased communication.
Denis still had access to Rodin’s email. Beginning September 22, she read emails, downloaded internal PCF documents, and sent them to her friend, Eddings. Eddings then emailed PCF’s CEO, threatening to release...
On Saturday 17 January, the government of Iran claimed that the United States is making false accusations against the country in its latest attempt to “fuel tensions” in the region. It dismissed t...