Matthew Patane

mpatane@dmreg.com

The internet was set ablaze recently with headlines declaring that it might be illegal for consumers to share their passwords for Netflix, HBO Now and other pay services.

But don't fret, according to three Des Moines legal experts. A recent federal appeals court decision that set off the furor was aimed more at employees sharing company passwords — and taking information — than consumers who want to give their account passwords to their children or a significant other.

The question arose after a U.S. Appeals Court in California issued a ruling this month that broached the issue of sharing passwords.

Here's what happened:

David Nosal, the defendant in the case, had worked for headhunting firm Korn/Ferry International but left to start his own competing company with colleagues. Korn/Ferry revoked Nosal's credentials to access their systems.

But before leaving Korn/Ferry, Nosal's co-workers downloaded information from the firm's systems to use at their new company. They later continued to access Korn/Ferry's systems using the credentials of a different co-worker.

"Everyone is focusing on the fact that David Nosal and his co-conspirators engaged in what has been called 'password sharing,'" Jim Pray, an attorney with Des Moines-based BrownWinick, said in an email.

"What may be missing from some discussions of the case is the fact that Mr. Nosal knowingly engaged in a conspiracy to steal a very valuable company-owned database so that he could use that database to compete against his former employer. This is tantamount to outright theft, something that prosecutors are interested in prosecuting."

Netflix in July: Here's what's coming/going

The majority on the three-member appeals court upheld that Nosal illegally accessed data on a former employer's computer systems "without authorization." That action, they ruled, violated the Computer Fraud and Abuse Act and the Economic Espionage Act.

Nosal's case had nothing explicitly to do with password sharing for video streaming services — something the majority pointed out in their arguments.

The lone dissenting judge, Stephen Reinhardt, however, argued the opposite, writing: "This case is about password sharing."

Reinhardt argued that the court ruling declaring Nosal's actions violate the CFAA "threatens to criminalize all sorts of innocuous conduct engaged in daily by ordinary citizens."

"I don’t see anything in the majority ruling that states definitively that sharing passwords" is illegal, said Brett Trout, a Des Moines-based attorney.

Companies such as Netflix likely would have to pursue restrictions on password sharing for them to be enforced.

"If HBO and Netflix and Hulu were not on board with criminally prosecuting people, I think it’s extremely unlikely with a prosecutor picking up that case," Trout said.

Pray made a similar point.

"Prosecutors are not likely to be interested in pushing the envelope on what is a garden-variety violation of company policies," Pray said.

Executives at both Netflix and HBO have said in the past they are OK with password sharing, at least for now.

Terms of service agreements from HBO Now, Netflix and Hulu all ask users to keep their passwords to themselves, in part because of security concerns. The language, though, doesn't explicitly prohibit users from authorizing others to use their accounts.

For instance, Netflix's terms of service reads: "The Account Owner has access and control over the Netflix account. The Account Owner's control is exercised through use of the Account Owner's password and therefore to maintain exclusive control, the Account Owner should not reveal the password to anyone."

Hulu's states: "Please keep your password confidential. … Because you are responsible for all use of your account, including unauthorized use by any third party, please be very careful to guard the security of your password."

Even if companies restricted password sharing in their user agreements, that doesn't automatically make it a federal crime.

"It is highly unlikely … that a court would say (password sharing) is a violation of federal law. It might be a violation of Netflix policy, but it’s not a violation of federal law," said Shontavia Johnson, a law professor at Drake University.

But, as Trout pointed out, the appeals court didn't exactly put the issue to rest either. The ruling only applies to the Nosal case.

It doesn't rule out a company in the future bringing a case forward to prevent password sharing.

It also doesn't prevent companies or prosecutors from using password sharing by an employee as leverage if the worker violated corporate policies, Pray said.