In the iconic scene from Norma Rae, Sally Field’s character climbs onto a factory worktable, raises a sign reading “UNION,” and silently compels the entire factory to confront what is happening. It is an act of defiance—but not trespass. She is where she is allowed to be. She is using what she has access to. The employer objects not to her presence, but to her purpose.

Now ask the question modern computer law increasingly forces us to confront: If Norma Rae had done the same thing using a company computer—communicating with coworkers, organizing, sharing information—would that be “hacking”?

That is not rhetorical anymore.

The complaint in SkyWest Airlines, Inc. v. Moussaron et al., No. 4:26-cv-00015 (D. Utah Jan. 30, 2026), reflects a growing trend: Using the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, as a weapon not against intrusion, but against disfavored use of information.

According to the complaint, two pilots accessed SkyWest’s internal portal using their own credentials and obtained contact information for fellow pilots. They allegedly used that information to facilitate union organizing. There is no claim of password cracking, privilege escalation, or bypassing technical barriers. The claim is simpler—and more troubling: that they “exceeded authorized access” because their use of the information violated company policy and nondisclosure agreements.

That is precisely the theory the Supreme Court rejected in Van Buren v. United States, 593 U.S. 374 (2021). The Court held that the CFAA is not a “misuse” statute. It does not criminalize accessing information for the wrong reason. It criminalizes accessing information one is not entitled to obtain. The distinction is not semantic—it is structural. The statute is grounded in a trespass model: whether the “gates” are open or closed, not whether the user’s intentions are pure.

The government in Van Buren argued that violating use restrictions—policies, agreements, expectations—should be enough. The Court rejected that approach, warning that it would transform the CFAA into a sweeping mechanism for criminalizing ordinary behavior, from violating workplace policies to breaching website terms of service. Id. at 386–87.

The SkyWest complaint attempts to revive that discredited theory in civil form. But because the CFAA is both a civil and criminal statute, see 18 U.S.C. § 1030(g), these civil theories do not remain confined to private disputes. They become test cases—prototypes—for future criminal prosecutions.

And this is not the first time employers have attempted to use the CFAA to police union-related or concerted activity.

In Register.com, Inc. v. Verio, Inc., 356 F.3d 393 (2d Cir. 2004),  although not a union case per se, the court entertained a theory that repeated access to publicly available data in violation of stated use restrictions could trigger liability. That theory later became a template for attempts to use the CFAA to enforce behavioral restrictions rather than technological ones.

More directly, in United States v. Nosal, 676 F.3d 854 (9th Cir. 2012), the government advanced a theory that employees who accessed company databases for competitive or disloyal purposes exceeded authorized access. The Ninth Circuit rejected that interpretation, emphasizing that the CFAA is not intended to enforce employer use restrictions or loyalty obligations.

Similarly, in LVRC Holdings LLC v. Brekka, 581 F.3d 1127 (9th Cir. 2009), the court held that an employee with valid credentials does not violate the CFAA by accessing information for an improper purpose, even if that purpose is adverse to the employer.

And in EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577 (1st Cir. 2001), the court allowed CFAA claims where former employees used insider knowledge to scrape data, a decision that has often been cited by employers seeking to stretch the statute into the realm of competitive or disloyal conduct—including, by analogy, organizing activity.

While there are relatively few reported decisions squarely addressing union organizing framed as CFAA violations, the doctrinal pattern is clear: employers repeatedly attempt to recast workplace disputes—including disloyalty, competition, and now organizing—as “unauthorized access,” and courts, particularly after Nosal and Van Buren, have increasingly rejected those efforts.

The SkyWest case pushes that boundary further by placing protected labor activity at the center of the dispute. Under the Railway Labor Act, 45 U.S.C. § 151 et seq., employees have the right to organize and communicate with one another regarding unionization. If accessing coworker contact information through authorized systems becomes a CFAA violation because of how that information is used, then the statute is being deployed not to protect computers, but to suppress collective activity.

That is where the Norma Rae analogy becomes more than rhetorical.

She stood on a table that she was allowed to be near. She spoke to people she was allowed to speak to. The employer objected to the message. Translating that into the digital world, the SkyWest theory suggests that using a company system for organizing—despite having access to that system—can be recast as a form of trespass.

But trespass does not work that way. And after Van Buren, neither does the CFAA.

The deeper problem is structural. Because the CFAA includes a civil cause of action, private litigants can advance expansive interpretations of a criminal statute without the constraints that typically accompany criminal enforcement—constitutional scrutiny, prosecutorial discretion, and internal DOJ limitations. If those interpretations gain traction, they become available to prosecutors in future cases.

In effect, civil litigation becomes a laboratory for expanding criminal law.

That has profound implications. If “exceeding authorized access” can be defined by reference to internal policies, nondisclosure agreements, or employer expectations, then the scope of criminal liability is no longer defined by Congress or the courts. It is defined by private actors. Employers, website operators, and data owners become the architects of criminal exposure.

And the consequences extend far beyond labor disputes. Journalists, whistleblowers, and security researchers all operate in spaces where access is authorized but use is contested. If misuse becomes the touchstone of liability, then any act of disclosure, investigation, or reporting can be reframed as a federal offense.

That is exactly what the Supreme Court rejected in Van Buren. The Court drew a bright line to prevent the CFAA from becoming a general-purpose “misuse” statute. The SkyWest complaint tests whether that line will hold.

Because if it does not, the next Norma Rae will not just be told to get off the table. She may be told she hacked it.

Recent Articles By Author