19 ms·

US Supreme Court Restricts Scope of Computer Fraud and Abuse Act [pdf]

442 points by panarky 5y ago

blakesterz 5y ago
I guess this is the part that matters most? "We must decide whether Van Buren also violated the Computer Fraud and Abuse Act of 1986 (CFAA), which makes it illegal “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” He did not. This provision covers those who obtain information from particular areas in the computer—such as files, folders, or databases—to which their computer access does not extend. It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them" Thomas, Alito and Roberts dissented, and I hate to say it, but I agree with them. "The question here is straightforward: Would an ordinary reader of the English language understand Van Buren to have “exceed[ed] authorized access” to the database when he used it under circumstances that were expressly forbidden? In my view, the answer is yes. The necessary precondition that permitted him to obtain that data was absent." That's Thomas dissenting.
- fossuser 5y ago
  > "This provision covers those who obtain information from particular areas in the computer—such as files, folders, or databases—to which their computer access does not extend. It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them" I think this would have acquitted Aaron Swartz (though he likely would have been acquitted anyway since they didn't even allege improper motive iirc). In his case he accessed journals that were available to him via MIT's open network. There is the second issue of his trespassing in a closet to leave a laptop on the network, but that would have been minor when compared to the string of felonies they charged him with which was tied to the CFAA. This seems like a good restriction to me at first glance.
  - vmception 5y ago
    Do you think people will be able to acknowledge that predisposition to suicide is what killed him and not the gravity of the DA obsession to convict him? The US doesn't have the most people in prison because long sentences caused everyone to kill themselves first, its because people do the time. I just see so much focus on needing to identify a catalyst (which doesn't affect most people) instead of the pre-existing mental health issue of the person. I think this hampers the necessary conversations to be had on suicide.
    - 0003 5y ago
      Look up the eggshell doctrine. From wikipedia: The rule states that, in a tort case, the unexpected frailty of the injured person is not a valid defense to the seriousness of any injury caused to them.
      - vmception 5y ago
        this wasn't a tort case, it was a criminal case even if the family sued the state civilly there would be nothing for the state to defend against
    - deleted 5y ago
      [deleted]
    - thebooktocome 5y ago
      I don't see the need to assign a single cause to a given event, to the exclusion of all others. Most events that occur have multiple causes, with varying degrees of importance.
      - vmception 5y ago
        people are misattributing the most important one, then: planning and following through with the action incompatible with maintaining a consciousness on this plane of existence.
    - fossuser 5y ago
- austincheney 5y ago
  Exceeded authorized access commonly refers to privilege escalation, which means access to a resource beyond his/her level of granted permission, whether by modification of technical controls, social engineering, or physical access. That is not what happened here. The access to the resource occurred exactly in accordance with the access controls and authority granted, but the motivation and intention were in clear ethical violation. Judge Barret said exactly this in her opinion.
- lmkg 5y ago
  The heart of this is the difference between legal authorization vs technical authorization. Legally, it is (or rather, used to be) OK to say "you have have access to data X for purpose Y." While the technical controls could not enforce restrictions on the purpose, it was understood that purpose limitation was valid. There was an understanding that technical controls are only an approximation of policy, and it's the policy that has legal weight when determining what access is authorized. Hopefully this particular case also runs afoul of other laws. Like something about granting access to unauthorized individuals, which is what the defendant was doing (selling government data). That can, and perhaps should be, separately illegal from accessing data for improper purposes.
  - phkahler 5y ago
    >> The heart of this is the difference between legal authorization vs technical authorization. We must not confuse legal authorization (felony for violation) with private or contractual agreements. Any law that allows private entities to define what actions constitute a felony is bad, and hopefully unconstitutional. Technical access measures are somewhat like physical locks. Terms of use are more similar to contracts. IANAL so my analogies my be crap.
    - ClumsyPilot 5y ago
      This is a very good point and what people often confuse. There is a crime of breaking and entering - and thats well defined. Then there are permissions of: "you can be in my house as long as you dont use the bathrolm and only wear pink socks" - if a person were to wear green socks, you can icik them out, but it does not suddenly become a home invasion
- kayodelycaon 5y ago
  The argument against the dissent is CFAA defines the terms used. Ordinary reader rule does not apply in that circumstance and nor should it.
- burkaman 5y ago
  The court's hypothetical is useful: > For instance, employers commonly state that computers and electronic devices can be used only for business purposes. On the Government’s reading, an employee who sends a personal e-mail or reads the news using a work computer has violated the CFAA. Accessing data for a forbidden reason should be a fireable offense, but not criminal. So if Thomas is right, it's a very bad law. I'm not sure I agree with him though. I think if you asked an average person, they might say something like "yes I am authorized to access that database, because I have credentials, but I'm not supposed to without a good reason". I don't think there is a single plain English reading of this phrase that any large group of people would agree on.
- ncallaway 5y ago
  I don't agree. I think the other judges have the better reading of the specific language of the text. Thomas, Alito, and Roberts don't even take their dissent on the interpretation offered by the Government, but have to craft their own—extremely broad—interpretation of "entitled". Since I think the opinion (at least, the little bit of it that I've skimmed) makes a fairly compelling case around the majority's interpretation of the words "so" and "entitled" I won't rehash that here. But, if we back up to the purpose and intent of the legislation, I think this outcome also better aligns with that. The CFAA was designed to curtain the unauthorized use of computers. To make it illegal for people to deliberately circumventing the security measures built into computers to obtain information or cause other harm. If I hand you a computer, tell you the password, and ask you to login to my computer and respond to an email for me, but then ask you not to look in the `Taxes` folder on the desktop should it be a felony for you to open the `Taxes` folder? That conceptually feels wrong to me. I have violated your trust, sure, but I haven't committed fraud, and I haven't abused any access control mechanisms on the computer. Or another scenario: your work gives you a work computer, and has a paragraph in the employee handbook that says you are never allowed to visit news.ycombinator.com on the work computer. At some point while working at the company, you visit news.ycombinator.com on the work computer. Have you just committed a felony? You've "exceeded the authorized access", if you interpret "entitled" and "authorized" as broadly as Thomas, Alito, and Roberts seem to. Should that really be a felony? That interpretation leads to such a massive broadening of felony criminal liability. It doesn't gut-check for me. That, combined with what I perceive as the better textual reading of the phrases "so" and "entitled", I have to disagree with you. I think the other 6 justices had the better argument at multiple levels.
  - merpnderp 5y ago
    I initially agreed with Justice Thomas's viewpoint but you really make it clear that he is wrong.
  - WillPostForFood 5y ago
    That interpretation leads to such a massive broadening of felony criminal liability. It doesn't gut-check for me I agree with you, it totally fails the gut check, but it is because the law is poorly written. The Supreme Court bailed out the lawmakers by winging it here. The minority opinion is the worse, but more accurate plain reading of the law.
- fooey 5y ago
  I very much feel their ruling is correct. The CFAA is intended to target "hackers," not policy violations. Here's a quote from the ruling making the point that applying the law to something like access policy is far too broad to be viable > The Government’s interpretation of the “exceeds authorized access” clause would attach criminal penalties to a breathtaking amount of commonplace computer activity. For instance, employers commonly state that computers and electronic devices can be used only for business purposes. On the Government’s reading, an employee who sends a personal e-mail or reads the news using a work computer has violated the CFAA. The Government speculates that other provisions might limit its prosecutorial power, but its charging practice and policy indicate otherwise. The Government’s approach would also inject arbitrariness into the assessment of criminal liability, because whether conduct like Van Buren’s violated the CFAA would depend on how an employer phrased the policy violated
  - anonymousiam 5y ago
    I agree that the ruling is correct. The officer was granted the accesses he had, and he was fully authorized to use them. He violated a department policy by using his access improperly. The government wants to turn policy violations into a felony, and even set up a sting operation in this case to get a felony conviction. The officer should be disciplined/fired/etc. for violating department policy, but the CFAA should not be used to turn him into a felon.
    - yarcob 5y ago
      The problem is that the officer is corrupt, and he should be charged for taking a bribe. I don't think corruption is "just a policy violation", but I don't know enough about US law to know if taking bribes make you a felon or not (I would hope so, but I assume it depends on circumstances). In any case, it shouldn't matter that he used a computer to commit a crime. If he had gotten the relevant information by reading them from a paper file or by asking a coworker the crime should be the same, in my opinion.
      - Natsu 5y ago
- generalizations 5y ago
  It sounds similar to the problem of someone with access to a file cabinet, where they aren't allowed to use some of the files in the cabinet, but are allowed to access other files in the same cabinet.
  - AnimalMuppet 5y ago
    And if do access the files that they aren't allowed to, we don't charge them with safecracking. They did something, but safecracking doesn't fit.
    - badRNG 5y ago
      Similar to if someone does something they aren't supposed to in a business, they aren't immediately charged with breaking and entering or trespass.
- buu700 5y ago
  My initial reaction was to agree with you, but based on my reading of the law I actually have to support the majority opinion: https://www.law.cornell.edu/uscode/text/18/1030#e_6 https://www.law.cornell.edu/uscode/text/18/1030#e_6 (6) the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter; The language here is relatively narrow. Nathan did "access a computer with authorization", and he didn't obtain information that he was "not entitled so to obtain or alter". He may have obtained it for a purpose that was expressly forbidden by the department policy, but he was permitted to obtain the information in and of itself. To qualify as being "under circumstances that were expressly forbidden", I think it would have to be a situation wherein he wasn't allowed to obtain the information in general, e.g. if he were only allowed to access it within certain hours or with a superior present. It's like the difference between giving someone your phone (which, for the sake of argument, qualifies as a "protected computer" in this scenario) and telling them that they can go through your photos so long as they don't take out their own phone and photograph any of them, and telling them that they can only open your photos while you're watching. It would be extremely rude in either case to secretly take your phone and exfiltrate your photos — and may even still be a crime in and of itself (and/or lead to follow-on crimes) — but I wouldn't consider the former to violate this particular law.
- deleted 5y ago
  [deleted]
- duxup 5y ago
  Plain English to me seems like the person in question had authorized access. His actions maybe should be criminal in some way (time to write a law maybe), but his access was authorized.
- lumost 5y ago
  This is the outcome of a legislative branch which can no longer legislate effectively. The courts have to "interpret" the laws into a sensible form of common law which minimizes the difference between the legislation, and practical governance concerns. Interpreting the law in such a way as to make private policy makers the arbiters of felony charges is not compatible with our society. This would be the equivalent of a restaurant letting you in, asking you to take a seat, and then charging you with a felony for choosing the wrong seat as listed on a tiny sign in the back of the restaurant.
- nullc 5y ago
  Civil and criminal law are distinct for a reason. In criminal law the consequences for your wrongs are much more dire-- you face the power of the state against you and you can be denied your freedom. Triggering the CFAA on policy violations creates a general tool to convert civil matters into not just a crime, but a relatively serious one! It essentially lets system operators write private law with criminal enforcement without the oversight of the public. To give a silly example: Your landlord prohibits you from painting your walls. Their payments website has some terms of US that makes it a CFAA violation to use their site with painted walls. Suddenly what otherwise might be a lawsuit over the $500 cost to repaint is a state funded attack where you face ten years in prison. It's clearly wrong to use the CFAA that way in the silly example, but it's no less wrong in less silly cases. Saying the CFAA can't be used to create private criminal law doesn't mean that policy violations can't be prosecuted-- but it means they should be prosecuted under other laws (with intentionally matched terms and penalties) or as civil matters.
  - failwhaleshark 5y ago
    Actual hacking into a network with intent should be on the order of breaking-and-entering, not robbing a bank, murder, or committing acts of terrorism. Hacking to rob a bank should be the same as robbing a bank. Hacking to intentionally poison a water supply is something like terrorism. Cracking, gnireenigne copy-protection, copying a publicly-/privately-available archive of information, etc. should be "speeding tickets" not 50 years in pound-me-in-the-ass federal pen. Hacking should be seen as an amoral means to commit another act, not a specific criminal, malicious activity in-and-of-itself.
- cletus 5y ago
  A policy change by your employer shouldn't lead to the possibility of a criminal prosecution for "hacking" and that's the net result of what you're suggesting and what that interpretation would mean. To me this is the definition of overreach.
- appleflaxen 5y ago
  Would that make you a criminal if you mistyped your URL, and ended up looking at someone else's document? It seems like it would to me, and I don't like that interpretation. If you want me to keep out, then keep me out. Don't make something available to me and then accuse me of a felony when I see it.
- deleted 5y ago
  [deleted]
- whiddershins 5y ago
  Based on your quote, with no other context, using your authentication to access information you aren’t supposed to access is verbatim the scenario the law speaks to.
tehwebguy 5y ago
Wow, guess it's a good thing our courts love corrupt cops more than they hate everyone else? What this guy did is one of the very few things that someone should actually get hit with the CFAA for. He abused access to police databases as a cop but he's off the hook because even though he was explicitly not allowed to do so, he was able to (as in, the system did not intend to prevent it). I guess if that's what it takes to narrow this bad law, fine!
- QuadmasterXLII 5y ago
  It sure looks like it. I wonder if we can get any other unjust laws overturned this way? With a single FBI sting that tricks a cop into smoking weed on camera, we could end the drug war!
- walshemj 5y ago
  Murdoc's tabloids will love this
- einpoklum 5y ago
  Abuse of power and CFAA violations aren't the same thing. Not that the former is not rampant in the US and among the police in particular...
- rswail 5y ago
  He can be prosecuted under any number of other laws, but the CFAA was not one of them. Has nothing to do with corrupt, or otherwise, cops. So SCOTUS just ruled that this is not "one of the very few things that someone should actually get hit with the CFAA for". He was bribed to do something he is explicitly not allowed to do, so he accepted a bribe (crime). He provided information to someone not authorized to receive it that he is explicitly not allowed to do (crime). He did it over the phone, so wire fraud (crime). etc.
telotortium 5y ago
I wonder how the market for compliance and authorization tools and services will react to this ruling. I would guess they will have a lot of increased business - even though employers can always fire an employee that violates policy, it will probably strengthen their case to ensure that the employee is also breaking the law, especially in unionized workplaces or other places where formal policies around termination are especially important.
- elliekelly 5y ago
  What a silly and cynical comment. Most employers (the vast majority even!) aren’t looking to set their employees up to become criminals when they fail to follow company policy. Usually the goal of a policy is to have a fail-safe: where even if the policy is violated the law isn’t.
dogman144 5y ago
This quietly, but I think significantly, changes the considerations for IAM and similar access controls. In the wild, these always trend towards overly permissive. Almost every company, tech or not, mature or not, deals with this. This ruling shifts a fair amount of responsibility to IAM teams to get it right now, as CFAA won’t back them up as much anymore.
- NovemberWhiskey 5y ago
  I don't know it makes much difference for internal controls. The implicit threat that backs the control is the disciplining of the employee, not their criminal prosecution.
  - dogman144 5y ago
    Disagree as someone who’s built these, prosecution is an ultimate fallback in AUPs, employee handbooks, etc. HR teams ultimately don’t have a ton of teeth or willpower unless there are laws involved, and now there is not legal coverage.
    - NovemberWhiskey 5y ago
      If it matters, I was speaking as someone who led the authorization platform team for a Fortune 100 company. I do suppose this depends significantly on company culture. In my experience: failure to abide by company policy is first-and-foremost a compliance issue; the company policy framework definitely goes above and beyond the scope of "what is criminal". HR is primarily there to provide to manage records of employee conduct (e.g. in case of a pervasive pattern of misconduct across a number of different controls) and a sanctioning mechanism (hard conversation; formal reprimand; separation).
      - dogman144 5y ago
        Yeah def a company culture thing. I agree it’s a compliance issue, this is def GRC, and agree with your def of HR. What I notice is HR likes to really move on employees when it has legal protection to do so. What a “pervasive pattern of misconduct” is often has a law behind it in some form, as otherwise you risk a wrongful termination lawsuit. So, if you have a situation where an employee’s pattern of misconduct sources back to only, or at the root, IAM allowing it (say an extreme scenario like consistently nuking prod), there is now some gray area for those wrongful termination suits.
dsr_ 5y ago
This seems to me to be the correct decision. Van Buren should have been charged with: GA 332: Abuse of official power GA 333: Exceeding official powers GA 338: Bribe-taking and, Federally, 18USC 201, which prohibits public officials from taking bribes.
- a1369209993 5y ago
  There should be some snooping/violation-of-privacy charges as well, but otherwise that sounds about right. CFAA is not relevant here.
  - a1369209993 5y ago
    > CFAA is not relevant here. Er, CFAA is not relevant to the criminal case againt Van Buren, I mean.
- Natsu 5y ago
  I'd imagine they were, by the time things get to the Supreme Court, they're dealing with very narrow issues of law and not the entire case.
rkagerer 5y ago
An analogy: Imagine I give you a key which opens two doors, and tell you to only use it on the first one. Entering the prohibited room isn't an offense under this act. But circumventing a lock on a third door for which you don't have a key would be. i.e. The judges interpreted it as intending to capture hacking, not policy violations.
- colechristensen 5y ago
  Or stated differently, the judges explicitly denied giving policy the force of law so that you can’t be charged for a crime for going against an employee handbook or license agreement rule.
- ViViDboarder 5y ago
  Even that analogy makes it sound more severe as it’s a door that you’ve been asked to stay out of. They used a door that they frequently are required to use but for a purpose other than what they were authorized to do. Eg. You can use this door to do A but you use the door to do B. Or, car analogies! You are given a car for work and told it can only be used for business purposes, but you use it to drive to the grocery. Or, something closer to technical which may be familiar to people. You’ve given a laptop for work only but you browse HackerNews on it. All are against the policies of those that granted you access to the device, but would they constitute unauthorized access?
deleted 5y ago
[deleted]
nostrademons 5y ago
There's an important distinction between levels of government and civil vs. criminal penalties here. From section a.4 of the holding: "The relevant question, however, is not whether Van Buren exceeded his authorized access but whether he exceeded his authorized access as the CFAA defines that phrase." The CFAA is a federal statute that governs unauthorized access to computer systems. When granting authorized access to computer systems, other organizations (whether states or police departments or private companies) are free to set their own policies, and they can enforce those policies with the mechanisms they have available to them, like terminating the offending officer or revoking his computer access (at which point further access would be a CFAA violation). But can they then use the language of the CFAA to criminalize violations of their own authorization policies? This holding says no - the CFAA covers the initial access to the computer system, and then violation of more granular access policy is a civil matter between the individual parties. This is consistent with several other recent court positions. There was a recent case to criminalize ToU violations [1]; the court ruled that this is an overbroad reading of the CFAA and ToU violations were civil matters between parties. When Anthony Levandowski used Google's network to download self-driving car plans and sell them to Uber [2], he was prosecuted under "theft of trade secret" laws, not under the CFAA. It's also analogous to perpetual free speech battles, where the court has repeatedly ruled that private parties are free to restrict speech on their own property, and that the 1st amendment applies only to the government. In general liberal democracies seek to apply restrictions as narrowly as possible and have private parties work out contracts and consequences amongst themselves, only stepping in when there is no way to enforce such agreements without an outside power. [1] https://arstechnica.com/tech-policy/2020/03/court-violating-a-sites-terms-of-service-isnt-criminal-hacking/ https://arstechnica.com/tech-policy/2020/03/court-violating-... [2] https://www.justice.gov/usao-ndca/pr/former-uber-executive-sentenced-18-months-jail-trade-secret-theft-google https://www.justice.gov/usao-ndca/pr/former-uber-executive-s...
duxup 5y ago
If someone has access to data, but uses it inappropriately. That doesn't sound like something that should be covered by “exceed authorized access”. If someone is using that information inappropriately, maybe that should be a against the law, but not the Computer Fraud and Abuse Act.
jmspring 5y ago
I wonder if the raid in 1990 on Steve Jackson Games fell under this particular act. http://www.sjgames.com/SS/ http://www.sjgames.com/SS/
- ncallaway 5y ago
  Almost certainly not. My understanding of the SJ Games raid was that the Secret Service was issued a search warrant by a court prior to the raid. 18 U.S. Code § 1030 (f) explicitly excepts lawfully authorized investigative activity of a law enforcement agency. The Secret Service is such a law enforcement agency, the raid was an investigatory activity, and since they obtained a search warrant prior to the raid it was a "lawfully authorized" search. As such, even if there might be liability based on their actions under the other portions of the section (I have no idea on this aspect, I'm not too familiar with the details of what they did as part of the search and seizure), the waiver in (f) is extremely broad and would apply to the Secret Service in that particular case. > (f) This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030
  - jmspring 5y ago
    Thanks!
cletus 5y ago
I'm surprised at the negativity here. I agree with this decision. When I saw it was a 6-3 decision my first instinct was "oh another conservative-liberal divide" but no it isn't. I'm actually surprised to find Thomas dissenting since he's just. a stickler for the literal text. To me the ruling seems correct: the offender may have exceeded department rules and such access by that measure was "unauthorized" but he was not an unauthorized user to the system. It's refreshing to see limits to the overreach on what constitutes "hacking". This isn't hacking. Were this ruling in effect when Aaron Swartz was charged, I very much suspect it would've invalidated the hacking charges under the CFAA (since he used a guest account he had access to).
- duxup 5y ago
  Agreed. This is a policy violation, and maybe that should be illegal in some way or have consequences. I'd be ok with that, but it's just not "exceed authorized access". The person in this case was authorized. The idea that you could be authorized, but suddenly not because of a policy doesn't make sense to me and that's kinda weird because that seems right up Thomas's literal interpretation alley (come on Thomas, use it right for once). Imagine Comcast changes a policy, and suddenly you're in violation of Computer Fraud and Abuse Act (CFAA).
  - secothroa 5y ago
    Policies, by definition, are ways by which authorization rules are enforced. If the officer violated a policy, they also by definition violated their authorizations. >The idea that you could be authorized, but suddenly not They were never authorized to use this system in this way, so there was not a "authorized but then suddenly not". The officer's authorization was static: not authorized. Authorization is more than just the technical controls in a system, and lack of a technical control to prevent an officer using a system in certain ways does not mean said officer is authorized to use the system in any way they please.
    - badRNG 5y ago
      I think we are confusing two concepts here. The officer's actions were unauthorized on a system he was provided access to. He didn't gain unauthorized access to a system, he failed to follow the rules on a system he already had access to.
spoonjim 5y ago
Oof. I don't like this decision, and surprised to see the breadth of agreement from the Court. When you grant a person access to a system (digital or physical), it's for a specific purpose. Violating that purpose should be a criminal act. If I give a plumber my house key to come in and fix my sink, and he goes and he opens up my computer and looks at my files, that should be a crime. If I grant a Geek Squadder access to my computer to get a virus off my computer, and he looks at my private photos except to the extent necessary to do the job I hired him to do, that should be a crime. One could always say "Congress can remedy this with legislation" but that body has become fully dysfunctional so we all know that won't happen.
- J5892 5y ago
  Yes, it likely should be a criminal act, and it may even be covered by one. But it should not be a violation of the CFAA. In your Geek Squadder case, you gave him access to the computer. He may have used that access improperly, but he did not increase his access through any illicit means. It is likely a crime, but not one that should be covered by the CFAA. Your plumber case is a much different scenario. Also definitely a crime, but you did not grant him access to the machine. So it's possible that the CFAA should cover that, but I don't have the knowledge required to answer that with any amount of certainty.
CA0DA 5y ago
How would the Aaron Schwartz case been affected if this decision had been made before?
- romwell 5y ago
  I am not a lawyer, but it really looks like Schwartz would not have been convicted on CFAA charges. However, he was also charged with wire fraud. The gov't was throwing the book at him. If it wasn't one law, it would've been another, and if it didn't apply, they'd still convict (and he'd have to spend years appealing the decision). Sadly, I don't think it would have saved Aaron Schwartz.
  - emiraga 5y ago
    Also not a lawyer, but wire fraud was because of circumventing IP address restrictions. Which is hard to claim that such act is defrauding anyone of money or property.
Animats 5y ago
This is an important decision, in that it means that violations of terms of service are not criminal offenses.
- dane-pgp 5y ago
  A good example for how terms of service have been weaponised by prosecutors in the past (using the CFAA) is the case United States v. Drew which focused on a Myspace account that had been created with a fake name: https://en.wikipedia.org/wiki/United_States_v._Drew https://en.wikipedia.org/wiki/United_States_v._Drew
nickysielicki 5y ago
In what world is it reasonable for the FBI to go around and bribe small-town police officers in order to charge them under the CFAA? WTF.
- ok123456 5y ago
  They do anti-corruption stings like this. The most famous was probably ABSCAM (https://en.wikipedia.org/wiki/Abscam https://en.wikipedia.org/wiki/Abscam). I'd rather them devote resources to anti-corruption like this than "drugs".
devmor 5y ago
I am loath to defend agents of the government, law officers or otherwise; but I have to agree with the decision here. Van Buren violated department policy, and perhaps other laws in his conduct. But he did not gain unauthorized access to a system. He already had authorized access - he just used it improperly. Similarly, if I were granted access to my company's production database to perform some kind of operation that required me to read/write data, and I used that privilege to access financial records of customers, I would certainly be violating my company's policy and likely some privacy and financial laws. But it would not be gaining unauthorized access, as I was explicitly granted access to that system - just for a different purpose.
aftbit 5y ago
I wonder if this precedent would have had any impact on weev's case. https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://en.wikipedia.org/wiki/Weev#AT&T_data_breach
- Miner49er 5y ago
  I was wondering the same thing, and I don't think it would. I am not a lawyer, and I guess we can't know why the jury voted guilty, but I think the arguments were that weev didn't have authorization. They argued that there was several "gates" weev had to go through to access AT&T's data. 1) User agent. He changed the user agent to that of an iPad. 2) The ID themselves. He only had to increment them to get to a new one, but they argued these were like a password. 3) Going to a URL that wasn't linked from somewhere. I'm not kidding. https://www.techdirt.com/articles/20130929/15371724695/dojs-insane-argument-against-weev-hes-felon-because-he-broke-rules-we-made-up.shtml https://www.techdirt.com/articles/20130929/15371724695/dojs-... So I think in weev's case, they argued he never had authorization at all. Whereas, in Van Buren's case, "The parties agree that Van Buren “access[ed] a computer with authorization”. So the problem was whether or not he exceeded authorization, not if he had it in the first place.
viztor 5y ago
I don't think the agent's action is proper, but it had nothing to do with computer fraud per se, nor is it the legislation intention. Suppose someone was granted access to evidence room, but had a look at the evidence that is not of his case, or a case file that he have access to for reasons not work-related. And those generally falls in the area of internal regulation, in which case the agency takes the legal blame for the agent, and should it take actions against the agent, it might be supported. Plain simply, even if those records are physical the referred agent could have done the same thing. Logically, it's not a matter of abusive conduct through computer, it's a matter of abusing public power.
Dan_JiuJitsu 5y ago
Just so I understand here; he's still on the hook for taking the bribe and running the license plate, he's just been cleared of unauthorized access because he was granted access to the system. Right? Seems to me the prosecutor messed up when charging him under CFAA, which as we can see here is a complex and nuanced section of law, instead of something straightforward, if less sexy like public corruption/bribery.
theginger 5y ago
Summary please. It's a lengthy document with quite complex language. The impression I got from reading the introduction is it was pretty clear which way the ruling went, but some of the comments here seem to be based on the opposite so there seems to be some confusion. So please can someone please sum it up in 1 or 2 lines?
- 1vuio0pswjnm7 5y ago
  "[E]xceed[ing] authorised access" (EAA) may occur where information accessed is located in "areas of the computer that are off-limits", e.g., "files, folders, databases". Access for an unauthorised purpose does not amount to EAA. I was aiming for 160 chars (2 lines of 80 chars). Not so easy.
- smsm42 5y ago
  The question was if you accessed the data which you are authorized to access (like police database for a policeman) but then used it for the purposes which are not part of your duties (like a corrupt policeman selling these data to criminals) can you be charged under CFAA. The SCOTUS said no, if you are authorized, then you are authorized, and the fact that you used the data later for an unauthorized purpose does not make the access itself a crime under CFAA (still could be a crime under a different law, of course). Thus, they restricted the reading of CFAA to a much narrower scope than the government wanted to apply.
  - smsm42 5y ago
    Also this probably blows a huge hole in the "EULA violation is a CFAA crime" argument. I'd say it probably would not survive this decision.
- rswail 5y ago
  if (not authorized && access system) { // unauthorized access = crime } else (if authorized && access system && access data && (authorized to access data && only under certain circumstances)) { // FBI/prosecution said = crime // SCOTUS said if authorized to access, but not in circumstances, // then ! crime under CFAA but may be crime under other laws } Basically, it comes down to that the system let the user access the data, but their conditions of use where that they were only allowed to do it under certain situations (in this case, as a cop, when involved in a traffic stop, or some other activity). The prosecution tried to say that this was a crime under CFAA, SCOTUS said that if the user is allowed to access the data, then it's not a breach of CFAA to do so.
chmod600 5y ago
Questions: * Should there be a distinction between violating a written policy; and bypassing a technical barrier? * Should there be a distinction between doing something that you are ordinarily permitted to do, but for an unpermitted purpose; and doing something that you are just never permitted to do? It seems that the Court didn't answer the first question, which is more interesting to me.
- rswail 5y ago
  That's been answered in other cases where someone violated a ToU and SCOTUS ruled that's not a breach of CFAA and not a criminal act. The second situation they've just ruled is not a crime under CFAA. That second clause "you are just never permitted to do" would depend on whether it was implemented as an employment policy or as a technical implementation that you "hack".
WCSTombs 5y ago
Here's EFF's take, which IMO is correct: https://www.eff.org/deeplinks/2021/06/supreme-court-overturns-overbroad-interpretation-cfaa-protecting-security https://www.eff.org/deeplinks/2021/06/supreme-court-overturn...
- segfaultbuserr 5y ago
  The EFF has been arguing for limiting the scope of the vague CFAA for two decades already, I'm happy to see some progress on this issue.
donatj 5y ago
https://en.wikipedia.org/wiki/Van_Buren_v._United_States https://en.wikipedia.org/wiki/Van_Buren_v._United_States > The FBI set up a sting operation and instructed Albo to offer Van Buren US$6,000, but in exchange, to request Van Buren look up a license plate on the Georgia Crime Information Center (GCIC) he had authorized access to, as to see if its registered owner, a stripper, was an undercover officer What ever happened to entrapment being… you know… against the law? Like I'm aware these sorts of stings happen all the time. What I don't understand is why it's generally found to be OK.
- jlmorton 5y ago
  Entrapment is not against the law, but it is a legal defense at trial against a charge. In any event, this is not entrapment, because it was not coercive. It's not entrapment to offer someone a reasonable amount of money to commit a crime, that's standard police work. It's only entrapment if the person refuses the offer, and law enforcement harasses them, repeatedly suggesting someone commit a crime until they are eventually convinced to do it.
- ceejayoz 5y ago
  Entrapment has specific requirements to apply, namely, that the person would not normally have committed the crime. Wearing someone down for years with harassment? Threats? Lies like “you have to do this or someone would die?” Entrapment.
  - deleted 5y ago
    [deleted]
  - donatj 5y ago
    How is that different than offering someone 6 grand? Had no one offered him six grand he never would have committed the crime. Like there's literally no victim here other than the accused.
    - ceejayoz 5y ago
      He would’ve happily accepted the $6k from someone else who wasn’t part of a sting. That’s why it’s not entrapment. If they had to beg and cajole and plead and coerce, it would’ve been entrapment. Same reason prostitution stings aren’t entrapment.
supergirl 5y ago
did the court clarify what "authorized" means? seems that the opinion hinges on that definition. does it mean just knowing the right user name and password? what if the login page also had a check box "I agree to use this system only to perform my job". if the cop lies and checks this box, does it mean he's not authorized? if lying about the check box is OK, what if he had used a colleague's user name and password for the criminal activity? he's still authorized just he didn't use his own password to commit the crime. would that still not make it CFAA?
rurabe 5y ago
There are so many things going on here it's easy to conflate them but here's how I read it: The CFAA is a law about how access is attained not what is accessed. There may or may not be other laws that have penalties for what is accessed given the nature of what is accessed, but that is a separate issue from the CFAA. For example, I am sure that there is some statue I would be in violation of for walking out of a CIA office with a binder of classified information. This should be illegal regardless of how it's accomplished. By contrast I think it should probably be a crime to gain access to a system through either technical exploits or social engineering, even if all you do is access cat memes that were public anyway. Layered on these issues is whether you think judges should stick to literal textual interpretations or rule based on the projected impacts of their decisions. Personally, as many have laid out, a strict textual approach opens the door to let private companies write felony law for literally anything they want, which seems an unworkable way to run a society. I think it's much more prudent to restrict this law to methods of access and allow other laws dictate what can and can't be accessed or used (copyright law, state secrets etc). A final question is how to test for whether methods are authorized or not. Someone here suggested the test should be the inclusion of "material deception". This I think falls short because a lot of behavior that we would not want to criminalize would satisfy the test. Should it be illegal to use a VPN? Because I can see that being construed as material deception. Sacha Baron Cohen dressed up as Borat is unquestionable material deception but I don't think it should be illegal for him to use a computer when doing so. Ultimately I don't know that there is a bright line definition, but that's okay because we use a "reasonable person" standard a lot in law, (and we should seek to seat judges that are the most reasonable of us). - No reasonable person would impersonate another to customer service to steal their phone and thus password. - A reasonable person might want to use a VPN to avoid being tracked by private corporations. - No reasonable person would exploit a zero day bug on a major corporation. - A reasonable person might change their user agent to see how a site looks on a phone. - A reasonable person might look up and save articles from a database they have access to.
smsm42 5y ago
SCOTUSblog analysis: https://www.scotusblog.com/2021/06/diverse-six-justice-majority-rejects-broad-reading-of-computer-fraud-law/ https://www.scotusblog.com/2021/06/diverse-six-justice-major...
dudeinjapan 5y ago
The SC made the right call here. In order to dissent, you have to claim that all improper/illegal acts done with computers constitute a form of hacking under the CFAA, since the prevailing laws do not "authorize" one to use the computer in that fashion.
FpUser 5y ago
>"...to retrieve information about a particular license plate number in exchange for money..." This is a clear case of bribery. It is criminal. Not sure why was not the case prosecuted accordingly.
gentle 5y ago
I agree with this, but that cop, in that specific case, should have gone to jail.
- rswail 5y ago
  No one is arguing that he did not commit criminal acts, but breaching CFAA was not one of them.

442 points by panarky 5y ago

I guess this is the part that matters most? "We must decide whether Van Buren also violated the Computer Fraud and Abuse Act of 1986 (CFAA), which makes it illegal “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” He did not. This provision covers those who obtain information from particular areas in the computer—such as files, folders, or databases—to which their computer access does not extend. It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them" Thomas, Alito and Roberts dissented, and I hate to say it, but I agree with them. "The question here is straightforward: Would an ordinary reader of the English language understand Van Buren to have “exceed[ed] authorized access” to the database when he used it under circumstances that were expressly forbidden? In my view, the answer is yes. The necessary precondition that permitted him to obtain that data was absent." That's Thomas dissenting.

fossuser 5y ago
> "This provision covers those who obtain information from particular areas in the computer—such as files, folders, or databases—to which their computer access does not extend. It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them" I think this would have acquitted Aaron Swartz (though he likely would have been acquitted anyway since they didn't even allege improper motive iirc). In his case he accessed journals that were available to him via MIT's open network. There is the second issue of his trespassing in a closet to leave a laptop on the network, but that would have been minor when compared to the string of felonies they charged him with which was tied to the CFAA. This seems like a good restriction to me at first glance.
- vmception 5y ago
  Do you think people will be able to acknowledge that predisposition to suicide is what killed him and not the gravity of the DA obsession to convict him? The US doesn't have the most people in prison because long sentences caused everyone to kill themselves first, its because people do the time. I just see so much focus on needing to identify a catalyst (which doesn't affect most people) instead of the pre-existing mental health issue of the person. I think this hampers the necessary conversations to be had on suicide.
  - 0003 5y ago
    Look up the eggshell doctrine. From wikipedia: The rule states that, in a tort case, the unexpected frailty of the injured person is not a valid defense to the seriousness of any injury caused to them.
    - vmception 5y ago
      this wasn't a tort case, it was a criminal case even if the family sued the state civilly there would be nothing for the state to defend against
  - deleted 5y ago
    [deleted]
  - thebooktocome 5y ago
    I don't see the need to assign a single cause to a given event, to the exclusion of all others. Most events that occur have multiple causes, with varying degrees of importance.
    - vmception 5y ago
      people are misattributing the most important one, then: planning and following through with the action incompatible with maintaining a consciousness on this plane of existence.
  - fossuser 5y ago
austincheney 5y ago
Exceeded authorized access commonly refers to privilege escalation, which means access to a resource beyond his/her level of granted permission, whether by modification of technical controls, social engineering, or physical access. That is not what happened here. The access to the resource occurred exactly in accordance with the access controls and authority granted, but the motivation and intention were in clear ethical violation. Judge Barret said exactly this in her opinion.
lmkg 5y ago
The heart of this is the difference between legal authorization vs technical authorization. Legally, it is (or rather, used to be) OK to say "you have have access to data X for purpose Y." While the technical controls could not enforce restrictions on the purpose, it was understood that purpose limitation was valid. There was an understanding that technical controls are only an approximation of policy, and it's the policy that has legal weight when determining what access is authorized. Hopefully this particular case also runs afoul of other laws. Like something about granting access to unauthorized individuals, which is what the defendant was doing (selling government data). That can, and perhaps should be, separately illegal from accessing data for improper purposes.
- phkahler 5y ago
  >> The heart of this is the difference between legal authorization vs technical authorization. We must not confuse legal authorization (felony for violation) with private or contractual agreements. Any law that allows private entities to define what actions constitute a felony is bad, and hopefully unconstitutional. Technical access measures are somewhat like physical locks. Terms of use are more similar to contracts. IANAL so my analogies my be crap.
  - ClumsyPilot 5y ago
    This is a very good point and what people often confuse. There is a crime of breaking and entering - and thats well defined. Then there are permissions of: "you can be in my house as long as you dont use the bathrolm and only wear pink socks" - if a person were to wear green socks, you can icik them out, but it does not suddenly become a home invasion
kayodelycaon 5y ago
The argument against the dissent is CFAA defines the terms used. Ordinary reader rule does not apply in that circumstance and nor should it.
burkaman 5y ago
The court's hypothetical is useful: > For instance, employers commonly state that computers and electronic devices can be used only for business purposes. On the Government’s reading, an employee who sends a personal e-mail or reads the news using a work computer has violated the CFAA. Accessing data for a forbidden reason should be a fireable offense, but not criminal. So if Thomas is right, it's a very bad law. I'm not sure I agree with him though. I think if you asked an average person, they might say something like "yes I am authorized to access that database, because I have credentials, but I'm not supposed to without a good reason". I don't think there is a single plain English reading of this phrase that any large group of people would agree on.
ncallaway 5y ago
I don't agree. I think the other judges have the better reading of the specific language of the text. Thomas, Alito, and Roberts don't even take their dissent on the interpretation offered by the Government, but have to craft their own—extremely broad—interpretation of "entitled". Since I think the opinion (at least, the little bit of it that I've skimmed) makes a fairly compelling case around the majority's interpretation of the words "so" and "entitled" I won't rehash that here. But, if we back up to the purpose and intent of the legislation, I think this outcome also better aligns with that. The CFAA was designed to curtain the unauthorized use of computers. To make it illegal for people to deliberately circumventing the security measures built into computers to obtain information or cause other harm. If I hand you a computer, tell you the password, and ask you to login to my computer and respond to an email for me, but then ask you not to look in the `Taxes` folder on the desktop should it be a felony for you to open the `Taxes` folder? That conceptually feels wrong to me. I have violated your trust, sure, but I haven't committed fraud, and I haven't abused any access control mechanisms on the computer. Or another scenario: your work gives you a work computer, and has a paragraph in the employee handbook that says you are never allowed to visit news.ycombinator.com on the work computer. At some point while working at the company, you visit news.ycombinator.com on the work computer. Have you just committed a felony? You've "exceeded the authorized access", if you interpret "entitled" and "authorized" as broadly as Thomas, Alito, and Roberts seem to. Should that really be a felony? That interpretation leads to such a massive broadening of felony criminal liability. It doesn't gut-check for me. That, combined with what I perceive as the better textual reading of the phrases "so" and "entitled", I have to disagree with you. I think the other 6 justices had the better argument at multiple levels.
- merpnderp 5y ago
  I initially agreed with Justice Thomas's viewpoint but you really make it clear that he is wrong.
- WillPostForFood 5y ago
  That interpretation leads to such a massive broadening of felony criminal liability. It doesn't gut-check for me I agree with you, it totally fails the gut check, but it is because the law is poorly written. The Supreme Court bailed out the lawmakers by winging it here. The minority opinion is the worse, but more accurate plain reading of the law.
fooey 5y ago
I very much feel their ruling is correct. The CFAA is intended to target "hackers," not policy violations. Here's a quote from the ruling making the point that applying the law to something like access policy is far too broad to be viable > The Government’s interpretation of the “exceeds authorized access” clause would attach criminal penalties to a breathtaking amount of commonplace computer activity. For instance, employers commonly state that computers and electronic devices can be used only for business purposes. On the Government’s reading, an employee who sends a personal e-mail or reads the news using a work computer has violated the CFAA. The Government speculates that other provisions might limit its prosecutorial power, but its charging practice and policy indicate otherwise. The Government’s approach would also inject arbitrariness into the assessment of criminal liability, because whether conduct like Van Buren’s violated the CFAA would depend on how an employer phrased the policy violated
- anonymousiam 5y ago
  I agree that the ruling is correct. The officer was granted the accesses he had, and he was fully authorized to use them. He violated a department policy by using his access improperly. The government wants to turn policy violations into a felony, and even set up a sting operation in this case to get a felony conviction. The officer should be disciplined/fired/etc. for violating department policy, but the CFAA should not be used to turn him into a felon.
  - yarcob 5y ago
    The problem is that the officer is corrupt, and he should be charged for taking a bribe. I don't think corruption is "just a policy violation", but I don't know enough about US law to know if taking bribes make you a felon or not (I would hope so, but I assume it depends on circumstances). In any case, it shouldn't matter that he used a computer to commit a crime. If he had gotten the relevant information by reading them from a paper file or by asking a coworker the crime should be the same, in my opinion.
    - Natsu 5y ago
generalizations 5y ago
It sounds similar to the problem of someone with access to a file cabinet, where they aren't allowed to use some of the files in the cabinet, but are allowed to access other files in the same cabinet.
- AnimalMuppet 5y ago
  And if do access the files that they aren't allowed to, we don't charge them with safecracking. They did something, but safecracking doesn't fit.
  - badRNG 5y ago
    Similar to if someone does something they aren't supposed to in a business, they aren't immediately charged with breaking and entering or trespass.
buu700 5y ago
My initial reaction was to agree with you, but based on my reading of the law I actually have to support the majority opinion: https://www.law.cornell.edu/uscode/text/18/1030#e_6 https://www.law.cornell.edu/uscode/text/18/1030#e_6 (6) the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter; The language here is relatively narrow. Nathan did "access a computer with authorization", and he didn't obtain information that he was "not entitled so to obtain or alter". He may have obtained it for a purpose that was expressly forbidden by the department policy, but he was permitted to obtain the information in and of itself. To qualify as being "under circumstances that were expressly forbidden", I think it would have to be a situation wherein he wasn't allowed to obtain the information in general, e.g. if he were only allowed to access it within certain hours or with a superior present. It's like the difference between giving someone your phone (which, for the sake of argument, qualifies as a "protected computer" in this scenario) and telling them that they can go through your photos so long as they don't take out their own phone and photograph any of them, and telling them that they can only open your photos while you're watching. It would be extremely rude in either case to secretly take your phone and exfiltrate your photos — and may even still be a crime in and of itself (and/or lead to follow-on crimes) — but I wouldn't consider the former to violate this particular law.
deleted 5y ago
[deleted]
duxup 5y ago
Plain English to me seems like the person in question had authorized access. His actions maybe should be criminal in some way (time to write a law maybe), but his access was authorized.
lumost 5y ago
This is the outcome of a legislative branch which can no longer legislate effectively. The courts have to "interpret" the laws into a sensible form of common law which minimizes the difference between the legislation, and practical governance concerns. Interpreting the law in such a way as to make private policy makers the arbiters of felony charges is not compatible with our society. This would be the equivalent of a restaurant letting you in, asking you to take a seat, and then charging you with a felony for choosing the wrong seat as listed on a tiny sign in the back of the restaurant.
nullc 5y ago
Civil and criminal law are distinct for a reason. In criminal law the consequences for your wrongs are much more dire-- you face the power of the state against you and you can be denied your freedom. Triggering the CFAA on policy violations creates a general tool to convert civil matters into not just a crime, but a relatively serious one! It essentially lets system operators write private law with criminal enforcement without the oversight of the public. To give a silly example: Your landlord prohibits you from painting your walls. Their payments website has some terms of US that makes it a CFAA violation to use their site with painted walls. Suddenly what otherwise might be a lawsuit over the $500 cost to repaint is a state funded attack where you face ten years in prison. It's clearly wrong to use the CFAA that way in the silly example, but it's no less wrong in less silly cases. Saying the CFAA can't be used to create private criminal law doesn't mean that policy violations can't be prosecuted-- but it means they should be prosecuted under other laws (with intentionally matched terms and penalties) or as civil matters.
- failwhaleshark 5y ago
  Actual hacking into a network with intent should be on the order of breaking-and-entering, not robbing a bank, murder, or committing acts of terrorism. Hacking to rob a bank should be the same as robbing a bank. Hacking to intentionally poison a water supply is something like terrorism. Cracking, gnireenigne copy-protection, copying a publicly-/privately-available archive of information, etc. should be "speeding tickets" not 50 years in pound-me-in-the-ass federal pen. Hacking should be seen as an amoral means to commit another act, not a specific criminal, malicious activity in-and-of-itself.
cletus 5y ago
A policy change by your employer shouldn't lead to the possibility of a criminal prosecution for "hacking" and that's the net result of what you're suggesting and what that interpretation would mean. To me this is the definition of overreach.
appleflaxen 5y ago
Would that make you a criminal if you mistyped your URL, and ended up looking at someone else's document? It seems like it would to me, and I don't like that interpretation. If you want me to keep out, then keep me out. Don't make something available to me and then accuse me of a felony when I see it.
deleted 5y ago
[deleted]
whiddershins 5y ago
Based on your quote, with no other context, using your authentication to access information you aren’t supposed to access is verbatim the scenario the law speaks to.

tehwebguy 5y ago

Wow, guess it's a good thing our courts love corrupt cops more than they hate everyone else? What this guy did is one of the very few things that someone should actually get hit with the CFAA for. He abused access to police databases as a cop but he's off the hook because even though he was explicitly not allowed to do so, he was able to (as in, the system did not intend to prevent it). I guess if that's what it takes to narrow this bad law, fine!

QuadmasterXLII 5y ago
It sure looks like it. I wonder if we can get any other unjust laws overturned this way? With a single FBI sting that tricks a cop into smoking weed on camera, we could end the drug war!
walshemj 5y ago
Murdoc's tabloids will love this
einpoklum 5y ago
Abuse of power and CFAA violations aren't the same thing. Not that the former is not rampant in the US and among the police in particular...
rswail 5y ago
He can be prosecuted under any number of other laws, but the CFAA was not one of them. Has nothing to do with corrupt, or otherwise, cops. So SCOTUS just ruled that this is not "one of the very few things that someone should actually get hit with the CFAA for". He was bribed to do something he is explicitly not allowed to do, so he accepted a bribe (crime). He provided information to someone not authorized to receive it that he is explicitly not allowed to do (crime). He did it over the phone, so wire fraud (crime). etc.

telotortium 5y ago

I wonder how the market for compliance and authorization tools and services will react to this ruling. I would guess they will have a lot of increased business - even though employers can always fire an employee that violates policy, it will probably strengthen their case to ensure that the employee is also breaking the law, especially in unionized workplaces or other places where formal policies around termination are especially important.

elliekelly 5y ago
What a silly and cynical comment. Most employers (the vast majority even!) aren’t looking to set their employees up to become criminals when they fail to follow company policy. Usually the goal of a policy is to have a fail-safe: where even if the policy is violated the law isn’t.

dogman144 5y ago

This quietly, but I think significantly, changes the considerations for IAM and similar access controls. In the wild, these always trend towards overly permissive. Almost every company, tech or not, mature or not, deals with this. This ruling shifts a fair amount of responsibility to IAM teams to get it right now, as CFAA won’t back them up as much anymore.

NovemberWhiskey 5y ago
I don't know it makes much difference for internal controls. The implicit threat that backs the control is the disciplining of the employee, not their criminal prosecution.
- dogman144 5y ago
  Disagree as someone who’s built these, prosecution is an ultimate fallback in AUPs, employee handbooks, etc. HR teams ultimately don’t have a ton of teeth or willpower unless there are laws involved, and now there is not legal coverage.
  - NovemberWhiskey 5y ago
    If it matters, I was speaking as someone who led the authorization platform team for a Fortune 100 company. I do suppose this depends significantly on company culture. In my experience: failure to abide by company policy is first-and-foremost a compliance issue; the company policy framework definitely goes above and beyond the scope of "what is criminal". HR is primarily there to provide to manage records of employee conduct (e.g. in case of a pervasive pattern of misconduct across a number of different controls) and a sanctioning mechanism (hard conversation; formal reprimand; separation).
    - dogman144 5y ago
      Yeah def a company culture thing. I agree it’s a compliance issue, this is def GRC, and agree with your def of HR. What I notice is HR likes to really move on employees when it has legal protection to do so. What a “pervasive pattern of misconduct” is often has a law behind it in some form, as otherwise you risk a wrongful termination lawsuit. So, if you have a situation where an employee’s pattern of misconduct sources back to only, or at the root, IAM allowing it (say an extreme scenario like consistently nuking prod), there is now some gray area for those wrongful termination suits.

dsr_ 5y ago

This seems to me to be the correct decision. Van Buren should have been charged with: GA 332: Abuse of official power GA 333: Exceeding official powers GA 338: Bribe-taking and, Federally, 18USC 201, which prohibits public officials from taking bribes.

a1369209993 5y ago
There should be some snooping/violation-of-privacy charges as well, but otherwise that sounds about right. CFAA is not relevant here.
- a1369209993 5y ago
  > CFAA is not relevant here. Er, CFAA is not relevant to the criminal case againt Van Buren, I mean.
Natsu 5y ago
I'd imagine they were, by the time things get to the Supreme Court, they're dealing with very narrow issues of law and not the entire case.

rkagerer 5y ago

An analogy: Imagine I give you a key which opens two doors, and tell you to only use it on the first one. Entering the prohibited room isn't an offense under this act. But circumventing a lock on a third door for which you don't have a key would be. i.e. The judges interpreted it as intending to capture hacking, not policy violations.

colechristensen 5y ago
Or stated differently, the judges explicitly denied giving policy the force of law so that you can’t be charged for a crime for going against an employee handbook or license agreement rule.
ViViDboarder 5y ago
Even that analogy makes it sound more severe as it’s a door that you’ve been asked to stay out of. They used a door that they frequently are required to use but for a purpose other than what they were authorized to do. Eg. You can use this door to do A but you use the door to do B. Or, car analogies! You are given a car for work and told it can only be used for business purposes, but you use it to drive to the grocery. Or, something closer to technical which may be familiar to people. You’ve given a laptop for work only but you browse HackerNews on it. All are against the policies of those that granted you access to the device, but would they constitute unauthorized access?

deleted 5y ago

[deleted]

nostrademons 5y ago

There's an important distinction between levels of government and civil vs. criminal penalties here. From section a.4 of the holding: "The relevant question, however, is not whether Van Buren exceeded his authorized access but whether he exceeded his authorized access as the CFAA defines that phrase." The CFAA is a federal statute that governs unauthorized access to computer systems. When granting authorized access to computer systems, other organizations (whether states or police departments or private companies) are free to set their own policies, and they can enforce those policies with the mechanisms they have available to them, like terminating the offending officer or revoking his computer access (at which point further access would be a CFAA violation). But can they then use the language of the CFAA to criminalize violations of their own authorization policies? This holding says no - the CFAA covers the initial access to the computer system, and then violation of more granular access policy is a civil matter between the individual parties. This is consistent with several other recent court positions. There was a recent case to criminalize ToU violations [1]; the court ruled that this is an overbroad reading of the CFAA and ToU violations were civil matters between parties. When Anthony Levandowski used Google's network to download self-driving car plans and sell them to Uber [2], he was prosecuted under "theft of trade secret" laws, not under the CFAA. It's also analogous to perpetual free speech battles, where the court has repeatedly ruled that private parties are free to restrict speech on their own property, and that the 1st amendment applies only to the government. In general liberal democracies seek to apply restrictions as narrowly as possible and have private parties work out contracts and consequences amongst themselves, only stepping in when there is no way to enforce such agreements without an outside power. [1] https://arstechnica.com/tech-policy/2020/03/court-violating-a-sites-terms-of-service-isnt-criminal-hacking/ https://arstechnica.com/tech-policy/2020/03/court-violating-... [2] https://www.justice.gov/usao-ndca/pr/former-uber-executive-sentenced-18-months-jail-trade-secret-theft-google https://www.justice.gov/usao-ndca/pr/former-uber-executive-s...

duxup 5y ago

If someone has access to data, but uses it inappropriately. That doesn't sound like something that should be covered by “exceed authorized access”. If someone is using that information inappropriately, maybe that should be a against the law, but not the Computer Fraud and Abuse Act.

jmspring 5y ago

I wonder if the raid in 1990 on Steve Jackson Games fell under this particular act. http://www.sjgames.com/SS/ http://www.sjgames.com/SS/

ncallaway 5y ago
Almost certainly not. My understanding of the SJ Games raid was that the Secret Service was issued a search warrant by a court prior to the raid. 18 U.S. Code § 1030 (f) explicitly excepts lawfully authorized investigative activity of a law enforcement agency. The Secret Service is such a law enforcement agency, the raid was an investigatory activity, and since they obtained a search warrant prior to the raid it was a "lawfully authorized" search. As such, even if there might be liability based on their actions under the other portions of the section (I have no idea on this aspect, I'm not too familiar with the details of what they did as part of the search and seizure), the waiver in (f) is extremely broad and would apply to the Secret Service in that particular case. > (f) This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030
- jmspring 5y ago
  Thanks!

cletus 5y ago

I'm surprised at the negativity here. I agree with this decision. When I saw it was a 6-3 decision my first instinct was "oh another conservative-liberal divide" but no it isn't. I'm actually surprised to find Thomas dissenting since he's just. a stickler for the literal text. To me the ruling seems correct: the offender may have exceeded department rules and such access by that measure was "unauthorized" but he was not an unauthorized user to the system. It's refreshing to see limits to the overreach on what constitutes "hacking". This isn't hacking. Were this ruling in effect when Aaron Swartz was charged, I very much suspect it would've invalidated the hacking charges under the CFAA (since he used a guest account he had access to).

duxup 5y ago
Agreed. This is a policy violation, and maybe that should be illegal in some way or have consequences. I'd be ok with that, but it's just not "exceed authorized access". The person in this case was authorized. The idea that you could be authorized, but suddenly not because of a policy doesn't make sense to me and that's kinda weird because that seems right up Thomas's literal interpretation alley (come on Thomas, use it right for once). Imagine Comcast changes a policy, and suddenly you're in violation of Computer Fraud and Abuse Act (CFAA).
- secothroa 5y ago
  Policies, by definition, are ways by which authorization rules are enforced. If the officer violated a policy, they also by definition violated their authorizations. >The idea that you could be authorized, but suddenly not They were never authorized to use this system in this way, so there was not a "authorized but then suddenly not". The officer's authorization was static: not authorized. Authorization is more than just the technical controls in a system, and lack of a technical control to prevent an officer using a system in certain ways does not mean said officer is authorized to use the system in any way they please.
  - badRNG 5y ago
    I think we are confusing two concepts here. The officer's actions were unauthorized on a system he was provided access to. He didn't gain unauthorized access to a system, he failed to follow the rules on a system he already had access to.

spoonjim 5y ago

Oof. I don't like this decision, and surprised to see the breadth of agreement from the Court. When you grant a person access to a system (digital or physical), it's for a specific purpose. Violating that purpose should be a criminal act. If I give a plumber my house key to come in and fix my sink, and he goes and he opens up my computer and looks at my files, that should be a crime. If I grant a Geek Squadder access to my computer to get a virus off my computer, and he looks at my private photos except to the extent necessary to do the job I hired him to do, that should be a crime. One could always say "Congress can remedy this with legislation" but that body has become fully dysfunctional so we all know that won't happen.

J5892 5y ago
Yes, it likely should be a criminal act, and it may even be covered by one. But it should not be a violation of the CFAA. In your Geek Squadder case, you gave him access to the computer. He may have used that access improperly, but he did not increase his access through any illicit means. It is likely a crime, but not one that should be covered by the CFAA. Your plumber case is a much different scenario. Also definitely a crime, but you did not grant him access to the machine. So it's possible that the CFAA should cover that, but I don't have the knowledge required to answer that with any amount of certainty.

CA0DA 5y ago

How would the Aaron Schwartz case been affected if this decision had been made before?

romwell 5y ago
I am not a lawyer, but it really looks like Schwartz would not have been convicted on CFAA charges. However, he was also charged with wire fraud. The gov't was throwing the book at him. If it wasn't one law, it would've been another, and if it didn't apply, they'd still convict (and he'd have to spend years appealing the decision). Sadly, I don't think it would have saved Aaron Schwartz.
- emiraga 5y ago
  Also not a lawyer, but wire fraud was because of circumventing IP address restrictions. Which is hard to claim that such act is defrauding anyone of money or property.

Animats 5y ago

This is an important decision, in that it means that violations of terms of service are not criminal offenses.

dane-pgp 5y ago
A good example for how terms of service have been weaponised by prosecutors in the past (using the CFAA) is the case United States v. Drew which focused on a Myspace account that had been created with a fake name: https://en.wikipedia.org/wiki/United_States_v._Drew https://en.wikipedia.org/wiki/United_States_v._Drew

nickysielicki 5y ago

In what world is it reasonable for the FBI to go around and bribe small-town police officers in order to charge them under the CFAA? WTF.

ok123456 5y ago
They do anti-corruption stings like this. The most famous was probably ABSCAM (https://en.wikipedia.org/wiki/Abscam https://en.wikipedia.org/wiki/Abscam). I'd rather them devote resources to anti-corruption like this than "drugs".

devmor 5y ago

I am loath to defend agents of the government, law officers or otherwise; but I have to agree with the decision here. Van Buren violated department policy, and perhaps other laws in his conduct. But he did not gain unauthorized access to a system. He already had authorized access - he just used it improperly. Similarly, if I were granted access to my company's production database to perform some kind of operation that required me to read/write data, and I used that privilege to access financial records of customers, I would certainly be violating my company's policy and likely some privacy and financial laws. But it would not be gaining unauthorized access, as I was explicitly granted access to that system - just for a different purpose.

aftbit 5y ago

I wonder if this precedent would have had any impact on weev's case. https://en.wikipedia.org/wiki/Weev#AT&T_data_breach https://en.wikipedia.org/wiki/Weev#AT&T_data_breach

Miner49er 5y ago
I was wondering the same thing, and I don't think it would. I am not a lawyer, and I guess we can't know why the jury voted guilty, but I think the arguments were that weev didn't have authorization. They argued that there was several "gates" weev had to go through to access AT&T's data. 1) User agent. He changed the user agent to that of an iPad. 2) The ID themselves. He only had to increment them to get to a new one, but they argued these were like a password. 3) Going to a URL that wasn't linked from somewhere. I'm not kidding. https://www.techdirt.com/articles/20130929/15371724695/dojs-insane-argument-against-weev-hes-felon-because-he-broke-rules-we-made-up.shtml https://www.techdirt.com/articles/20130929/15371724695/dojs-... So I think in weev's case, they argued he never had authorization at all. Whereas, in Van Buren's case, "The parties agree that Van Buren “access[ed] a computer with authorization”. So the problem was whether or not he exceeded authorization, not if he had it in the first place.

viztor 5y ago

I don't think the agent's action is proper, but it had nothing to do with computer fraud per se, nor is it the legislation intention. Suppose someone was granted access to evidence room, but had a look at the evidence that is not of his case, or a case file that he have access to for reasons not work-related. And those generally falls in the area of internal regulation, in which case the agency takes the legal blame for the agent, and should it take actions against the agent, it might be supported. Plain simply, even if those records are physical the referred agent could have done the same thing. Logically, it's not a matter of abusive conduct through computer, it's a matter of abusing public power.

Dan_JiuJitsu 5y ago

Just so I understand here; he's still on the hook for taking the bribe and running the license plate, he's just been cleared of unauthorized access because he was granted access to the system. Right? Seems to me the prosecutor messed up when charging him under CFAA, which as we can see here is a complex and nuanced section of law, instead of something straightforward, if less sexy like public corruption/bribery.

theginger 5y ago

Summary please. It's a lengthy document with quite complex language. The impression I got from reading the introduction is it was pretty clear which way the ruling went, but some of the comments here seem to be based on the opposite so there seems to be some confusion. So please can someone please sum it up in 1 or 2 lines?

1vuio0pswjnm7 5y ago
"[E]xceed[ing] authorised access" (EAA) may occur where information accessed is located in "areas of the computer that are off-limits", e.g., "files, folders, databases". Access for an unauthorised purpose does not amount to EAA. I was aiming for 160 chars (2 lines of 80 chars). Not so easy.
smsm42 5y ago
The question was if you accessed the data which you are authorized to access (like police database for a policeman) but then used it for the purposes which are not part of your duties (like a corrupt policeman selling these data to criminals) can you be charged under CFAA. The SCOTUS said no, if you are authorized, then you are authorized, and the fact that you used the data later for an unauthorized purpose does not make the access itself a crime under CFAA (still could be a crime under a different law, of course). Thus, they restricted the reading of CFAA to a much narrower scope than the government wanted to apply.
- smsm42 5y ago
  Also this probably blows a huge hole in the "EULA violation is a CFAA crime" argument. I'd say it probably would not survive this decision.
rswail 5y ago
if (not authorized && access system) { // unauthorized access = crime } else (if authorized && access system && access data && (authorized to access data && only under certain circumstances)) { // FBI/prosecution said = crime // SCOTUS said if authorized to access, but not in circumstances, // then ! crime under CFAA but may be crime under other laws } Basically, it comes down to that the system let the user access the data, but their conditions of use where that they were only allowed to do it under certain situations (in this case, as a cop, when involved in a traffic stop, or some other activity). The prosecution tried to say that this was a crime under CFAA, SCOTUS said that if the user is allowed to access the data, then it's not a breach of CFAA to do so.

chmod600 5y ago

Questions: * Should there be a distinction between violating a written policy; and bypassing a technical barrier? * Should there be a distinction between doing something that you are ordinarily permitted to do, but for an unpermitted purpose; and doing something that you are just never permitted to do? It seems that the Court didn't answer the first question, which is more interesting to me.

rswail 5y ago
That's been answered in other cases where someone violated a ToU and SCOTUS ruled that's not a breach of CFAA and not a criminal act. The second situation they've just ruled is not a crime under CFAA. That second clause "you are just never permitted to do" would depend on whether it was implemented as an employment policy or as a technical implementation that you "hack".

WCSTombs 5y ago

Here's EFF's take, which IMO is correct: https://www.eff.org/deeplinks/2021/06/supreme-court-overturns-overbroad-interpretation-cfaa-protecting-security https://www.eff.org/deeplinks/2021/06/supreme-court-overturn...

segfaultbuserr 5y ago
The EFF has been arguing for limiting the scope of the vague CFAA for two decades already, I'm happy to see some progress on this issue.

donatj 5y ago

https://en.wikipedia.org/wiki/Van_Buren_v._United_States https://en.wikipedia.org/wiki/Van_Buren_v._United_States > The FBI set up a sting operation and instructed Albo to offer Van Buren US$6,000, but in exchange, to request Van Buren look up a license plate on the Georgia Crime Information Center (GCIC) he had authorized access to, as to see if its registered owner, a stripper, was an undercover officer What ever happened to entrapment being… you know… against the law? Like I'm aware these sorts of stings happen all the time. What I don't understand is why it's generally found to be OK.

jlmorton 5y ago
Entrapment is not against the law, but it is a legal defense at trial against a charge. In any event, this is not entrapment, because it was not coercive. It's not entrapment to offer someone a reasonable amount of money to commit a crime, that's standard police work. It's only entrapment if the person refuses the offer, and law enforcement harasses them, repeatedly suggesting someone commit a crime until they are eventually convinced to do it.
ceejayoz 5y ago
Entrapment has specific requirements to apply, namely, that the person would not normally have committed the crime. Wearing someone down for years with harassment? Threats? Lies like “you have to do this or someone would die?” Entrapment.
- deleted 5y ago
  [deleted]
- donatj 5y ago
  How is that different than offering someone 6 grand? Had no one offered him six grand he never would have committed the crime. Like there's literally no victim here other than the accused.
  - ceejayoz 5y ago
    He would’ve happily accepted the $6k from someone else who wasn’t part of a sting. That’s why it’s not entrapment. If they had to beg and cajole and plead and coerce, it would’ve been entrapment. Same reason prostitution stings aren’t entrapment.

supergirl 5y ago

did the court clarify what "authorized" means? seems that the opinion hinges on that definition. does it mean just knowing the right user name and password? what if the login page also had a check box "I agree to use this system only to perform my job". if the cop lies and checks this box, does it mean he's not authorized? if lying about the check box is OK, what if he had used a colleague's user name and password for the criminal activity? he's still authorized just he didn't use his own password to commit the crime. would that still not make it CFAA?

rurabe 5y ago

There are so many things going on here it's easy to conflate them but here's how I read it: The CFAA is a law about how access is attained not what is accessed. There may or may not be other laws that have penalties for what is accessed given the nature of what is accessed, but that is a separate issue from the CFAA. For example, I am sure that there is some statue I would be in violation of for walking out of a CIA office with a binder of classified information. This should be illegal regardless of how it's accomplished. By contrast I think it should probably be a crime to gain access to a system through either technical exploits or social engineering, even if all you do is access cat memes that were public anyway. Layered on these issues is whether you think judges should stick to literal textual interpretations or rule based on the projected impacts of their decisions. Personally, as many have laid out, a strict textual approach opens the door to let private companies write felony law for literally anything they want, which seems an unworkable way to run a society. I think it's much more prudent to restrict this law to methods of access and allow other laws dictate what can and can't be accessed or used (copyright law, state secrets etc). A final question is how to test for whether methods are authorized or not. Someone here suggested the test should be the inclusion of "material deception". This I think falls short because a lot of behavior that we would not want to criminalize would satisfy the test. Should it be illegal to use a VPN? Because I can see that being construed as material deception. Sacha Baron Cohen dressed up as Borat is unquestionable material deception but I don't think it should be illegal for him to use a computer when doing so. Ultimately I don't know that there is a bright line definition, but that's okay because we use a "reasonable person" standard a lot in law, (and we should seek to seat judges that are the most reasonable of us). - No reasonable person would impersonate another to customer service to steal their phone and thus password. - A reasonable person might want to use a VPN to avoid being tracked by private corporations. - No reasonable person would exploit a zero day bug on a major corporation. - A reasonable person might change their user agent to see how a site looks on a phone. - A reasonable person might look up and save articles from a database they have access to.

smsm42 5y ago

SCOTUSblog analysis: https://www.scotusblog.com/2021/06/diverse-six-justice-majority-rejects-broad-reading-of-computer-fraud-law/ https://www.scotusblog.com/2021/06/diverse-six-justice-major...

dudeinjapan 5y ago

The SC made the right call here. In order to dissent, you have to claim that all improper/illegal acts done with computers constitute a form of hacking under the CFAA, since the prevailing laws do not "authorize" one to use the computer in that fashion.

FpUser 5y ago

>"...to retrieve information about a particular license plate number in exchange for money..." This is a clear case of bribery. It is criminal. Not sure why was not the case prosecuted accordingly.

gentle 5y ago

I agree with this, but that cop, in that specific case, should have gone to jail.

rswail 5y ago
No one is arguing that he did not commit criminal acts, but breaching CFAA was not one of them.