4 ms·

I don't agree. I think the other judges have the better reading of the specific language of the text. Thomas, Alito, and Roberts don't even take their dissent

I don't agree. I think the other judges have the better reading of the specific language of the text. Thomas, Alito, and Roberts don't even take their dissent on the interpretation offered by the Government, but have to craft their own—extremely broad—interpretation of "entitled". Since I think the opinion (at least, the little bit of it that I've skimmed) makes a fairly compelling case around the majority's interpretation of the words "so" and "entitled" I won't rehash that here. But, if we back up to the purpose and intent of the legislation, I think this outcome also better aligns with that. The CFAA was designed to curtain the unauthorized use of computers. To make it illegal for people to deliberately circumventing the security measures built into computers to obtain information or cause other harm. If I hand you a computer, tell you the password, and ask you to login to my computer and respond to an email for me, but then ask you not to look in the `Taxes` folder on the desktop should it be a felony for you to open the `Taxes` folder? That conceptually feels wrong to me. I have violated your trust, sure, but I haven't committed fraud, and I haven't abused any access control mechanisms on the computer. Or another scenario: your work gives you a work computer, and has a paragraph in the employee handbook that says you are never allowed to visit news.ycombinator.com on the work computer. At some point while working at the company, you visit news.ycombinator.com on the work computer. Have you just committed a felony? You've "exceeded the authorized access", if you interpret "entitled" and "authorized" as broadly as Thomas, Alito, and Roberts seem to. Should that really be a felony? That interpretation leads to such a massive broadening of felony criminal liability. It doesn't gut-check for me. That, combined with what I perceive as the better textual reading of the phrases "so" and "entitled", I have to disagree with you. I think the other 6 justices had the better argument at multiple levels.

merpnderp 5y ago
I initially agreed with Justice Thomas's viewpoint but you really make it clear that he is wrong.
WillPostForFood 5y ago
That interpretation leads to such a massive broadening of felony criminal liability. It doesn't gut-check for me I agree with you, it totally fails the gut check, but it is because the law is poorly written. The Supreme Court bailed out the lawmakers by winging it here. The minority opinion is the worse, but more accurate plain reading of the law.
- ncallaway 5y ago
  Well, that ignores the part where I agree with the textual reading and interpretation of the majority. I think the majority opinion is also the more accurate plain reading of the law. So, from my perspective, no bailing out is necessary. The gut check and the plain reading both seem to align.
  - WillPostForFood 5y ago
    intentionally accesses a computer without authorization or exceeds authorized access Did he exceed authorized access? He did, and therefore he broke the plain reading of the law. The law should be better, and separate violating access controls from violation of access policy, but it doesn't.
    - ncallaway 5y ago
      > Did he exceed authorized access? He did not. He was given a level of authorization that he did not exceed. The problem, again, is in the ambiguity of the word “authorized” that allows multiple plain readings. To me, it’s absolutely plain that “authorized access” refers to system authorization (that is, what the computer tells the user their permissions are), and “exceeds authorized access” refers to bypassing the system authorization limits. That’s absolutely the plain reading to me. To you, you read “authorization” as “policy authorization” (that is, where another human tells you what your permission levels are). The fact is, there are multiple kinds of “authorization” involved in this case, which means different people can have different plain readings of the statute. While your reading seems obvious to you, it seems strained to me. My reading might be strained to you, but it’s obvious to me.
      - WillPostForFood 5y ago
        Since they didn't specify what type of authorization, the plain reading is that it covers all types.
        5y ago
mywittyname 5y ago
> but then ask you not to look in the `Taxes` folder on the desktop should it be a felony for you to open the `Taxes` folder? That conceptually feels wrong to me. I have violated your trust, sure, but I haven't committed fraud You accessed privileged information that you were explicitly not allowed. To me, asking you not to look at certain information is effectively the same as putting a password on it, then having you break it. In both cases, the intent of the owner is clear: do not access these files. And in both cases, the actions of the perpetrator very clearly disregard the owners intent. Your example about accessing a website is not the same. It's pretty clear that the person going to new.ycombinator.com is not stealing or accessing privileged information. There have been separate rulings dealing with whether or not employees can use corporate equipment for personal reasons. A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite. Unless, of course, the only reason the court ruled in favor of this person was that they are a police officer. But I guess we have to wait until the FBI attempts to press charges against someone at Google selling personal details to third parties to find out.
- johnnyapol 5y ago
  > A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite. No, this isn't what this means at all. This ruling just means you haven't committed a crime under the Computer Fraud and Abuse Act by accessing that data if you didn't "hack" to get access to it. Depending on the information you sold, you could've violated other laws and you definitely violated the Non-Disclosure agreement you signed with those companies. For reference, the cop in this case had other convictions under wire fraud laws that weren't changed by this.
- nokcha 5y ago
  >There have been separate rulings dealing with whether or not employees can use corporate equipment for personal reasons. Such rulings are about different laws. The government's interpretation would criminalize violating a protected computer's terms-of-service regardless of whether it is part of a corporate intranet or an ordinary website on the Internet. And yes, the government has pursued criminals charges for violating a website's ToS; see United States v. Drew, 259 F.R.D. 449 (C.D. Cal. 2009). >A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite. As to Humana, it would likely be a criminal HIPAA violation.
wlesieutre 5y ago
For the requisite car analogy: one is like a mechanic taking your car for a joyride after you give them the key, the other is a stranger taking it for a joyride after breaking in and stealing it out of your driveway. One of them is misusing a car that you gave them access to, the other one is stealing it.
- NovemberWhiskey 5y ago
  In my jurisdiction, a mechanic who takes a car for a joyride is committing a class A misdemeanor (unauthorized use of a vehicle in the third degree) ref. https://codes.findlaw.com/ny/penal-law/pen-sect-165-05.html https://codes.findlaw.com/ny/penal-law/pen-sect-165-05.html In other jurisdictions (like, say, New Hampshire), that same case falls into the definition of theft. http://www.gencourt.state.nh.us/rsa/html/LXII/637/637-9.htm http://www.gencourt.state.nh.us/rsa/html/LXII/637/637-9.htm
- pessimizer 5y ago
  That's because you're assuming the stranger doesn't return the car. If your mechanic takes your car for a joyride after you give them the key for purposes of repairing your car, and a stranger steals my car when I'm not using it and brings it back before I notice it's missing, I don't understand why one is any different or worse than the other.
unyttigfjelltol 5y ago
Judges interpret ambiguous laws narrowly to avoid criminal liability, as you say.[1] Three justices dissented though, I take it, because in their view the words weren't ambiguous, even if leniency would have been the better public policy. [1] https://en.m.wikipedia.org/wiki/Rule_of_lenity https://en.m.wikipedia.org/wiki/Rule_of_lenity

merpnderp 5y ago

I initially agreed with Justice Thomas's viewpoint but you really make it clear that he is wrong.

WillPostForFood 5y ago

That interpretation leads to such a massive broadening of felony criminal liability. It doesn't gut-check for me I agree with you, it totally fails the gut check, but it is because the law is poorly written. The Supreme Court bailed out the lawmakers by winging it here. The minority opinion is the worse, but more accurate plain reading of the law.

ncallaway 5y ago
Well, that ignores the part where I agree with the textual reading and interpretation of the majority. I think the majority opinion is also the more accurate plain reading of the law. So, from my perspective, no bailing out is necessary. The gut check and the plain reading both seem to align.
- WillPostForFood 5y ago
  intentionally accesses a computer without authorization or exceeds authorized access Did he exceed authorized access? He did, and therefore he broke the plain reading of the law. The law should be better, and separate violating access controls from violation of access policy, but it doesn't.
  - ncallaway 5y ago
    > Did he exceed authorized access? He did not. He was given a level of authorization that he did not exceed. The problem, again, is in the ambiguity of the word “authorized” that allows multiple plain readings. To me, it’s absolutely plain that “authorized access” refers to system authorization (that is, what the computer tells the user their permissions are), and “exceeds authorized access” refers to bypassing the system authorization limits. That’s absolutely the plain reading to me. To you, you read “authorization” as “policy authorization” (that is, where another human tells you what your permission levels are). The fact is, there are multiple kinds of “authorization” involved in this case, which means different people can have different plain readings of the statute. While your reading seems obvious to you, it seems strained to me. My reading might be strained to you, but it’s obvious to me.
    - WillPostForFood 5y ago
      Since they didn't specify what type of authorization, the plain reading is that it covers all types.
      - 5y ago

mywittyname 5y ago

> but then ask you not to look in the `Taxes` folder on the desktop should it be a felony for you to open the `Taxes` folder? That conceptually feels wrong to me. I have violated your trust, sure, but I haven't committed fraud You accessed privileged information that you were explicitly not allowed. To me, asking you not to look at certain information is effectively the same as putting a password on it, then having you break it. In both cases, the intent of the owner is clear: do not access these files. And in both cases, the actions of the perpetrator very clearly disregard the owners intent. Your example about accessing a website is not the same. It's pretty clear that the person going to new.ycombinator.com is not stealing or accessing privileged information. There have been separate rulings dealing with whether or not employees can use corporate equipment for personal reasons. A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite. Unless, of course, the only reason the court ruled in favor of this person was that they are a police officer. But I guess we have to wait until the FBI attempts to press charges against someone at Google selling personal details to third parties to find out.

johnnyapol 5y ago
> A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite. No, this isn't what this means at all. This ruling just means you haven't committed a crime under the Computer Fraud and Abuse Act by accessing that data if you didn't "hack" to get access to it. Depending on the information you sold, you could've violated other laws and you definitely violated the Non-Disclosure agreement you signed with those companies. For reference, the cop in this case had other convictions under wire fraud laws that weren't changed by this.
nokcha 5y ago
>There have been separate rulings dealing with whether or not employees can use corporate equipment for personal reasons. Such rulings are about different laws. The government's interpretation would criminalize violating a protected computer's terms-of-service regardless of whether it is part of a corporate intranet or an ordinary website on the Internet. And yes, the government has pursued criminals charges for violating a website's ToS; see United States v. Drew, 259 F.R.D. 449 (C.D. Cal. 2009). >A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite. As to Humana, it would likely be a criminal HIPAA violation.

wlesieutre 5y ago

For the requisite car analogy: one is like a mechanic taking your car for a joyride after you give them the key, the other is a stranger taking it for a joyride after breaking in and stealing it out of your driveway. One of them is misusing a car that you gave them access to, the other one is stealing it.

NovemberWhiskey 5y ago
In my jurisdiction, a mechanic who takes a car for a joyride is committing a class A misdemeanor (unauthorized use of a vehicle in the third degree) ref. https://codes.findlaw.com/ny/penal-law/pen-sect-165-05.html https://codes.findlaw.com/ny/penal-law/pen-sect-165-05.html In other jurisdictions (like, say, New Hampshire), that same case falls into the definition of theft. http://www.gencourt.state.nh.us/rsa/html/LXII/637/637-9.htm http://www.gencourt.state.nh.us/rsa/html/LXII/637/637-9.htm
pessimizer 5y ago
That's because you're assuming the stranger doesn't return the car. If your mechanic takes your car for a joyride after you give them the key for purposes of repairing your car, and a stranger steals my car when I'm not using it and brings it back before I notice it's missing, I don't understand why one is any different or worse than the other.

unyttigfjelltol 5y ago

Judges interpret ambiguous laws narrowly to avoid criminal liability, as you say.[1] Three justices dissented though, I take it, because in their view the words weren't ambiguous, even if leniency would have been the better public policy. [1] https://en.m.wikipedia.org/wiki/Rule_of_lenity https://en.m.wikipedia.org/wiki/Rule_of_lenity