12 ms·

I'm surprised at the negativity here. I agree with this decision. When I saw it was a 6-3 decision my first instinct was "oh another conservative-liberal divid

by cletus 5y ago

I'm surprised at the negativity here. I agree with this decision. When I saw it was a 6-3 decision my first instinct was "oh another conservative-liberal divide" but no it isn't. I'm actually surprised to find Thomas dissenting since he's just. a stickler for the literal text. To me the ruling seems correct: the offender may have exceeded department rules and such access by that measure was "unauthorized" but he was not an unauthorized user to the system. It's refreshing to see limits to the overreach on what constitutes "hacking". This isn't hacking. Were this ruling in effect when Aaron Swartz was charged, I very much suspect it would've invalidated the hacking charges under the CFAA (since he used a guest account he had access to).

duxup 5y ago
Agreed. This is a policy violation, and maybe that should be illegal in some way or have consequences. I'd be ok with that, but it's just not "exceed authorized access". The person in this case was authorized. The idea that you could be authorized, but suddenly not because of a policy doesn't make sense to me and that's kinda weird because that seems right up Thomas's literal interpretation alley (come on Thomas, use it right for once). Imagine Comcast changes a policy, and suddenly you're in violation of Computer Fraud and Abuse Act (CFAA).
- secothroa 5y ago
  Policies, by definition, are ways by which authorization rules are enforced. If the officer violated a policy, they also by definition violated their authorizations. >The idea that you could be authorized, but suddenly not They were never authorized to use this system in this way, so there was not a "authorized but then suddenly not". The officer's authorization was static: not authorized. Authorization is more than just the technical controls in a system, and lack of a technical control to prevent an officer using a system in certain ways does not mean said officer is authorized to use the system in any way they please.
  - badRNG 5y ago
    I think we are confusing two concepts here. The officer's actions were unauthorized on a system he was provided access to. He didn't gain unauthorized access to a system, he failed to follow the rules on a system he already had access to.
    - secothroa 5y ago
      It isn't just about access to the system, but access to the data as well, and he accessed data that he was not authorized to access. That is "exceeding authorized access". - Logging onto the system: officer has technical access to log on and is authorized to log on, no problem - Accessing normal data the officer needs for legitimate reason: officer has technical access to this data and is authorized to access it, no problem - Accessing data for the purpose of a bribe: officer has technical access to this data, but is not authorized to access it, thus they are exceeding their authorized access
      - kstrauser 5y ago
        His crime was violating the policy. He clearly did not hack into the computer system to get the data, and that's what the CFAA was meant to prosecute. Put another way, he didn't work around any computer controls to get at the information.
        secothroa 5y ago
        >Put another way, he didn't work around any computer controls to get at the information. That's irrelevant. You can do unauthorized things without having to "work around" controls. >He clearly did not hack into the computer system to get the data, and that's what the CFAA was meant to prosecute. The CFAA was meant to prevent computer-related crimes including but not limited to unauthorized access, fraud, abuse, etc, which this clearly was.
        kstrauser 5y ago
        > That's irrelevant. You can do unauthorized things without having to "work around" controls. SCOTUS disagrees with you, and so do I. > The CFAA was meant to prevent computer-related crimes including but not limited to unauthorized access, fraud, abuse, etc, which this clearly was. He didn't do any of those with respect to the computer system. He accessed a resource that he had authorization to access as part of his job. He misused it, but didn't break into the system or gain access by fraud. His reasons for accessing the data were wrong, but his access was authorized.
- badRNG 5y ago
  > This is a policy violation, and maybe that should be illegal in some way or have consequences. Sure, and usually policy violations that matter do involve civil consequences (e.g. litigation to recover damages) but not handing out felonies or putting someone in prison for a decade+.
  - duxup 5y ago
    I could see a law that has stricter terms for sensitive data, and civil servants with access to it. I'd be ok with that. Maybe even felonies depending on what occurred and whatever the law is. It's just the law in this case doesn't fit what happened.
    - deleted 5y ago
      [deleted]
  - stefan_ 5y ago
    This person sold access to restricted data and abused his privileged position as civil servant to do so. Maybe it's not CFAA, but I'm sure it should be a felony of some sort.
    - nostrademons 5y ago
      He should be charged with the laws against that, then, rather than the CFAA. This other poster mentioned some: https://news.ycombinator.com/item?id=27385624 https://news.ycombinator.com/item?id=27385624
      - kstrauser 5y ago
        Exactly. If he were charged with "bribery, and also public urination" for this, while I wouldn't be happy about what he did, it definitely wouldn't be public urination.
        xbar 5y ago
        Well argued, counselor.
- throwsadlfksjdf 5y ago
  I find both your and GP's swipes against Justice Thomas to be perplexing. Literal interpretation of the Constitution's meaning at the time it was written is exactly what you should want, not whatever that single judge feels should be or should have been the meaning. I don't see how that's a bad trait.
  - duxup 5y ago
    And I pointed out how he didn't do that.
- 1vuio0pswjnm7 5y ago
  "Imagine Comcast shanges a policy, and suddenly you're in violation of Computer Fraud and Abuse Act (CFAA)." That is only an argument, not a fact. They would have to persuade a court you are violation of the CFAA. That requires evidence. In almost all the previous cases with similar facts, the plaintiff provided notification and an instruction to cease and desist. Apparently, the plaintiff's lawyers or prosecutors thought they needed that as evidence. If you received such notfication, and you wished to avoid a CFAA claim, then you would follow the instruction and stop doing whatever Comcast is complaining about. And that would be the end of it. The thing about the Swartz case is that he broke into a network closet and connected his laptop with ethernet cable directly to an MIT computer (networking equipment) in the closet. Even with this latest USSC decision, how could that ever be "authorised [physical] access".
Natsu 5y ago
I agree with this decision, but I've always advocated my own personal test for whether access is 'unauthorized' or not. Basically, I would say that unauthorized access should require some material deception to gain access. So if you socially engineer your way in, it's unauthorized--you lied to someone. If you use a computer virus, it's unauthorized--you lied to the computer to get it to execute that code, probably misrepresenting it as some other type of data. If they set the permissions wrong or it's just an AUP thing, it's not unauthorized access. Though, as here, it might be against the law for some other reason (violation of privacy or whatever). This would avoid catching people out because someone set permissions to give too much access or wrote overbroad AUPs that shouldn't be turned into federal felonies, while providing a nice bright line because you can actually test whether, if not for the deception, they'd have been granted access to the system, especially the computer side of that. So the people who used anonymous FTP with a fake email won't become felons because it's easy to prove the system lets in everyone no matter what their email is set to, whereas the person using someone else's credentials lied to the system about who they are and should get punished, etc. I think that my test would be consistent with this holding, but remember that this is merely my view of how the law should be. It's not a description of how the law is, it's something I would advocate that I believe provides a reasonable boundary between authorized an unauthorized access that's both clear and testable.
- pessimizer 5y ago
  What if I, as your employer, say "you're not authorized to look at records that haven't been assigned to you" and you then look at a record that hasn't been assigned to you - is that unauthorized access? edit: I certainly don't agree that the distinction between access to a file in a file cabinet and a record on a computer should be significant. I think it's a dumb law. But the unauthorized access test is straightforward. If I work at a company that disallows internet browsing other than for work purposes and I visit my facebook page, I think that's a clear case of hacking under the "authorized access" test, and my only real defense would be that I needed to check facebook for work.
  - Natsu 5y ago
    I'd say that should only be fraud if you lied to get access, I don't agree with interpretations that allow any random AUP to create new felonies. Don't get me wrong, I understand how that can be straightforwardly interpreted as "unauthorized access." I'm advocating for what the law should be, in my view. The idea is to make a bright line that gives a test for mens rea to avoid over-criminalization while not being too unreasonable. I'm sure there could be scenarios I haven't thought of that would turn out poorly.
tomschlick 5y ago
> I'm surprised at the negativity here. If this were not a ruling in favor of a police officer, I feel that you would see a much more positive response. The past few years of political craziness have warped peoples' minds where they can't recognize a good thing anymore.
- raegis 5y ago
  Perhaps the ruling is correct because the judges went out of their way to save a police officer, but would not provide others the same courtesy. But I'm only speculating.
ggggtez 5y ago
It's almost as if textualism is just an excuse, and not actually a coherent legal view... I have mixed feelings on the ruling. It sounds to me like a crime did occur. But the CFAA is also overly vague... Without reading the details of the case and the statue, it's hard for me to be sure what to think here. I guess looking forward, this will force police departments and others to be more explicit in their access policies, which it sounds like here there just wasn't any? I guess that's a win?
- mardifoufs 5y ago
  As opposed to the very coherent legal view of a "living constitution"? Because sure, textualism can seem arbitrary at times, but it at least tries not to be. I don't understand what's more coherent about judges basically ignoring or rewriting the laws in whatever way they want, and do it openly under the pretext that they felt like "things just change bro, society is just different now & they didn't mean what they wrote anyways" It sounds pretty harsh but to me it's boils down to this: while textualism can lead to excesses & dubious interpretations by judges...The alternative can lead to any interpretation since it surrenders the entire judicial process to the judges while hoping they won't go too far because they just wouldn't dare?
- cletus 5y ago
  That is in fact exactly the problem with strict textualism: It's actually not that strict. I am sympathetic to the criticisms of the "living document" ideology. It's populism masquerading as jurisprudence. Or, as Scalia put it, it's no philosophy at all. HOWEVER, textualism is not as clean as it's advocates will argue. Case in point: The post-Civil War era Supreme Court (the so-called "Redeemer" court) went out of it's way to essentially dismantle legislation aimed to protecting minorities in the name of textualism. This was the origin of hate crime legislation, which came about because of jury nullification, essentially. Consider the aftermath of the Colifax massacre [1]: > This decision, in United States v. Cruikshank, the legal historian Lawrence Goldstone argues, provided a guide for the campaign of racist terrorism that would suppress the black vote and enshrine a white man’s government for generations. “The Colfax defendants would have had to announce their plan to violate their victims’ rights on account of the color of their skin in order to be culpable,” Goldstone wrote. “Justice Bradley had thus communicated to any Redeemer with violent intent that to avoid federal prosecution one need simply to keep one’s mouth shut before committing murder.” [1]: https://www.theatlantic.com/ideas/archive/2018/09/redemption-court/566963/ https://www.theatlantic.com/ideas/archive/2018/09/redemption...
r0m4n0 5y ago
Yep, I think this was a small win for the opponents of CFAA but this is a total show of force of the supreme court. This law is famously broad and to interpret it in its literal sense would mean the mass majority of the nation would be federal criminals (they point out some of the scenarios in the article). Instead of law makers fixing the problem, the supreme court is effectively reading between the lines. Luckily IMHO they are doing the right thing here and will put this particular employer based scenario to rest. Now to clarify on the countless other holes in the CFAA...
J5892 5y ago
Agreed. My initial reaction to the headline I read was anger that an officer got away with abusing his power. But upon learning the details, it's clear that a CFAA violation is an inappropriate charge here.
jrochkind1 5y ago
I wonder if the negative commenters are unaware of the history of CFAA prosecution abuse, and are coming at this for the first time only through this case. This is very, very good news. https://www.eff.org/deeplinks/2020/01/eff-asks-supreme-court-put-stop-dangerously-broad-interpretations-computer-fraud https://www.eff.org/deeplinks/2020/01/eff-asks-supreme-court... https://www.eff.org/deeplinks/2021/06/supreme-court-overturns-overbroad-interpretation-cfaa-protecting-security https://www.eff.org/deeplinks/2021/06/supreme-court-overturn...
pdonis 5y ago
I don't find either side's arguments particularly compelling in this case; they all look like legalistic sophistry to me more than anything else. I think the fundamental problem is that the CFAA is bad law, which means that there will be reasonable arguments on both sides any time it comes up in a court case. What should really happen is that the law should be changed.
- jdmichal 5y ago
  > What should really happen is that the law should be changed. And the way to make that happen is by limiting the scope of the law as much as possible, in order to force law makers to rewrite it. Which is what has happened here. If law makers did intend the rejected interpretation, then they should rewrite it to clarify such.
  - pdonis 5y ago
    > the way to make that happen is by limiting the scope of the law as much as possible, in order to force law makers to rewrite it. I doubt that will actually happen, though. Our system basically assumes that laws will be written to be vague and ambiguous, and that courts will clarify the interpretation over time. I don't think this is a very good way to run things, but it seems to be the way we've settled on.
    - jdmichal 5y ago
      Maybe. But it's a pretty strong component of the interaction between legislature and judiciary. Ambiguity should be resolved to make fewer things criminal. And then the legislature can disambiguate if they deem it important enough business to do so. https://en.wikipedia.org/wiki/Rule_of_lenity https://en.wikipedia.org/wiki/Rule_of_lenity
libeclipse 5y ago
They charged Swartz under many more things than just the Computer Fraud and Abuse Act. Just check out the list here: https://en.wikipedia.org/wiki/Aaron_Swartz#Arrest_and_prosecution https://en.wikipedia.org/wiki/Aaron_Swartz#Arrest_and_prosec... - two state charges of breaking and entering with intent to commit a felony - wire fraud, computer fraud, unlawfully obtaining information from a protected computer, and recklessly damaging a protected computer - breaking and entering with intent, grand larceny, and unauthorized access to a computer network - federal prosecutors filed a superseding indictment adding nine more felony counts, which increased Swartz's maximum criminal exposure to 50 years of imprisonment and $1 million in fines
walrus01 5y ago
> measure was "unauthorized" While I agree with your assessment, it was not just "unauthorized", it was straight up corruption. Making an agreement to accept a $5000 cash payment from some sketchy dude to look up a third party's accessible-to-law-enforcement only details. The guy should have been prosecuted under various existing corruption statutes and not the CFAA.
deleted 5y ago
[deleted]
zucker42 5y ago
I agree with this comment. In my opinion there should be stronger laws regarding the misuse of police power, but those can be implemented at the state level, the extension of the CFAA to that is dangerous. One key point is this document: > The Government’s interpretation of the “exceeds authorized access” clause would attach criminal penalties to a breathtaking amount of commonplace computer activity. For instance, employers commonly state that computers and electronic devices can be used only for business purposes. On the Government’s reading, an employee who sends a personal e-mail or reads the news using a work computer has violated the CFAA. The Government speculates that other provisions might limit its prosecutorial power, but its charging practice and policy indicate otherwise.

by cletus 5y ago

duxup 5y ago

Agreed. This is a policy violation, and maybe that should be illegal in some way or have consequences. I'd be ok with that, but it's just not "exceed authorized access". The person in this case was authorized. The idea that you could be authorized, but suddenly not because of a policy doesn't make sense to me and that's kinda weird because that seems right up Thomas's literal interpretation alley (come on Thomas, use it right for once). Imagine Comcast changes a policy, and suddenly you're in violation of Computer Fraud and Abuse Act (CFAA).

secothroa 5y ago
Policies, by definition, are ways by which authorization rules are enforced. If the officer violated a policy, they also by definition violated their authorizations. >The idea that you could be authorized, but suddenly not They were never authorized to use this system in this way, so there was not a "authorized but then suddenly not". The officer's authorization was static: not authorized. Authorization is more than just the technical controls in a system, and lack of a technical control to prevent an officer using a system in certain ways does not mean said officer is authorized to use the system in any way they please.
- badRNG 5y ago
  I think we are confusing two concepts here. The officer's actions were unauthorized on a system he was provided access to. He didn't gain unauthorized access to a system, he failed to follow the rules on a system he already had access to.
  - secothroa 5y ago
    It isn't just about access to the system, but access to the data as well, and he accessed data that he was not authorized to access. That is "exceeding authorized access". - Logging onto the system: officer has technical access to log on and is authorized to log on, no problem - Accessing normal data the officer needs for legitimate reason: officer has technical access to this data and is authorized to access it, no problem - Accessing data for the purpose of a bribe: officer has technical access to this data, but is not authorized to access it, thus they are exceeding their authorized access
    - kstrauser 5y ago
      His crime was violating the policy. He clearly did not hack into the computer system to get the data, and that's what the CFAA was meant to prosecute. Put another way, he didn't work around any computer controls to get at the information.
      - secothroa 5y ago
        >Put another way, he didn't work around any computer controls to get at the information. That's irrelevant. You can do unauthorized things without having to "work around" controls. >He clearly did not hack into the computer system to get the data, and that's what the CFAA was meant to prosecute. The CFAA was meant to prevent computer-related crimes including but not limited to unauthorized access, fraud, abuse, etc, which this clearly was.
        kstrauser 5y ago
        > That's irrelevant. You can do unauthorized things without having to "work around" controls. SCOTUS disagrees with you, and so do I. > The CFAA was meant to prevent computer-related crimes including but not limited to unauthorized access, fraud, abuse, etc, which this clearly was. He didn't do any of those with respect to the computer system. He accessed a resource that he had authorization to access as part of his job. He misused it, but didn't break into the system or gain access by fraud. His reasons for accessing the data were wrong, but his access was authorized.
badRNG 5y ago
> This is a policy violation, and maybe that should be illegal in some way or have consequences. Sure, and usually policy violations that matter do involve civil consequences (e.g. litigation to recover damages) but not handing out felonies or putting someone in prison for a decade+.
- duxup 5y ago
  I could see a law that has stricter terms for sensitive data, and civil servants with access to it. I'd be ok with that. Maybe even felonies depending on what occurred and whatever the law is. It's just the law in this case doesn't fit what happened.
  - deleted 5y ago
    [deleted]
- stefan_ 5y ago
  This person sold access to restricted data and abused his privileged position as civil servant to do so. Maybe it's not CFAA, but I'm sure it should be a felony of some sort.
  - nostrademons 5y ago
    He should be charged with the laws against that, then, rather than the CFAA. This other poster mentioned some: https://news.ycombinator.com/item?id=27385624 https://news.ycombinator.com/item?id=27385624
    - kstrauser 5y ago
      Exactly. If he were charged with "bribery, and also public urination" for this, while I wouldn't be happy about what he did, it definitely wouldn't be public urination.
      - xbar 5y ago
        Well argued, counselor.
throwsadlfksjdf 5y ago
I find both your and GP's swipes against Justice Thomas to be perplexing. Literal interpretation of the Constitution's meaning at the time it was written is exactly what you should want, not whatever that single judge feels should be or should have been the meaning. I don't see how that's a bad trait.
- duxup 5y ago
  And I pointed out how he didn't do that.
1vuio0pswjnm7 5y ago
"Imagine Comcast shanges a policy, and suddenly you're in violation of Computer Fraud and Abuse Act (CFAA)." That is only an argument, not a fact. They would have to persuade a court you are violation of the CFAA. That requires evidence. In almost all the previous cases with similar facts, the plaintiff provided notification and an instruction to cease and desist. Apparently, the plaintiff's lawyers or prosecutors thought they needed that as evidence. If you received such notfication, and you wished to avoid a CFAA claim, then you would follow the instruction and stop doing whatever Comcast is complaining about. And that would be the end of it. The thing about the Swartz case is that he broke into a network closet and connected his laptop with ethernet cable directly to an MIT computer (networking equipment) in the closet. Even with this latest USSC decision, how could that ever be "authorised [physical] access".

Natsu 5y ago

I agree with this decision, but I've always advocated my own personal test for whether access is 'unauthorized' or not. Basically, I would say that unauthorized access should require some material deception to gain access. So if you socially engineer your way in, it's unauthorized--you lied to someone. If you use a computer virus, it's unauthorized--you lied to the computer to get it to execute that code, probably misrepresenting it as some other type of data. If they set the permissions wrong or it's just an AUP thing, it's not unauthorized access. Though, as here, it might be against the law for some other reason (violation of privacy or whatever). This would avoid catching people out because someone set permissions to give too much access or wrote overbroad AUPs that shouldn't be turned into federal felonies, while providing a nice bright line because you can actually test whether, if not for the deception, they'd have been granted access to the system, especially the computer side of that. So the people who used anonymous FTP with a fake email won't become felons because it's easy to prove the system lets in everyone no matter what their email is set to, whereas the person using someone else's credentials lied to the system about who they are and should get punished, etc. I think that my test would be consistent with this holding, but remember that this is merely my view of how the law should be. It's not a description of how the law is, it's something I would advocate that I believe provides a reasonable boundary between authorized an unauthorized access that's both clear and testable.

pessimizer 5y ago
What if I, as your employer, say "you're not authorized to look at records that haven't been assigned to you" and you then look at a record that hasn't been assigned to you - is that unauthorized access? edit: I certainly don't agree that the distinction between access to a file in a file cabinet and a record on a computer should be significant. I think it's a dumb law. But the unauthorized access test is straightforward. If I work at a company that disallows internet browsing other than for work purposes and I visit my facebook page, I think that's a clear case of hacking under the "authorized access" test, and my only real defense would be that I needed to check facebook for work.
- Natsu 5y ago
  I'd say that should only be fraud if you lied to get access, I don't agree with interpretations that allow any random AUP to create new felonies. Don't get me wrong, I understand how that can be straightforwardly interpreted as "unauthorized access." I'm advocating for what the law should be, in my view. The idea is to make a bright line that gives a test for mens rea to avoid over-criminalization while not being too unreasonable. I'm sure there could be scenarios I haven't thought of that would turn out poorly.

tomschlick 5y ago

> I'm surprised at the negativity here. If this were not a ruling in favor of a police officer, I feel that you would see a much more positive response. The past few years of political craziness have warped peoples' minds where they can't recognize a good thing anymore.

raegis 5y ago
Perhaps the ruling is correct because the judges went out of their way to save a police officer, but would not provide others the same courtesy. But I'm only speculating.

ggggtez 5y ago

It's almost as if textualism is just an excuse, and not actually a coherent legal view... I have mixed feelings on the ruling. It sounds to me like a crime did occur. But the CFAA is also overly vague... Without reading the details of the case and the statue, it's hard for me to be sure what to think here. I guess looking forward, this will force police departments and others to be more explicit in their access policies, which it sounds like here there just wasn't any? I guess that's a win?

mardifoufs 5y ago
As opposed to the very coherent legal view of a "living constitution"? Because sure, textualism can seem arbitrary at times, but it at least tries not to be. I don't understand what's more coherent about judges basically ignoring or rewriting the laws in whatever way they want, and do it openly under the pretext that they felt like "things just change bro, society is just different now & they didn't mean what they wrote anyways" It sounds pretty harsh but to me it's boils down to this: while textualism can lead to excesses & dubious interpretations by judges...The alternative can lead to any interpretation since it surrenders the entire judicial process to the judges while hoping they won't go too far because they just wouldn't dare?
cletus 5y ago
That is in fact exactly the problem with strict textualism: It's actually not that strict. I am sympathetic to the criticisms of the "living document" ideology. It's populism masquerading as jurisprudence. Or, as Scalia put it, it's no philosophy at all. HOWEVER, textualism is not as clean as it's advocates will argue. Case in point: The post-Civil War era Supreme Court (the so-called "Redeemer" court) went out of it's way to essentially dismantle legislation aimed to protecting minorities in the name of textualism. This was the origin of hate crime legislation, which came about because of jury nullification, essentially. Consider the aftermath of the Colifax massacre [1]: > This decision, in United States v. Cruikshank, the legal historian Lawrence Goldstone argues, provided a guide for the campaign of racist terrorism that would suppress the black vote and enshrine a white man’s government for generations. “The Colfax defendants would have had to announce their plan to violate their victims’ rights on account of the color of their skin in order to be culpable,” Goldstone wrote. “Justice Bradley had thus communicated to any Redeemer with violent intent that to avoid federal prosecution one need simply to keep one’s mouth shut before committing murder.” [1]: https://www.theatlantic.com/ideas/archive/2018/09/redemption-court/566963/ https://www.theatlantic.com/ideas/archive/2018/09/redemption...

r0m4n0 5y ago

Yep, I think this was a small win for the opponents of CFAA but this is a total show of force of the supreme court. This law is famously broad and to interpret it in its literal sense would mean the mass majority of the nation would be federal criminals (they point out some of the scenarios in the article). Instead of law makers fixing the problem, the supreme court is effectively reading between the lines. Luckily IMHO they are doing the right thing here and will put this particular employer based scenario to rest. Now to clarify on the countless other holes in the CFAA...

J5892 5y ago

Agreed. My initial reaction to the headline I read was anger that an officer got away with abusing his power. But upon learning the details, it's clear that a CFAA violation is an inappropriate charge here.

jrochkind1 5y ago

I wonder if the negative commenters are unaware of the history of CFAA prosecution abuse, and are coming at this for the first time only through this case. This is very, very good news. https://www.eff.org/deeplinks/2020/01/eff-asks-supreme-court-put-stop-dangerously-broad-interpretations-computer-fraud https://www.eff.org/deeplinks/2020/01/eff-asks-supreme-court... https://www.eff.org/deeplinks/2021/06/supreme-court-overturns-overbroad-interpretation-cfaa-protecting-security https://www.eff.org/deeplinks/2021/06/supreme-court-overturn...

pdonis 5y ago

I don't find either side's arguments particularly compelling in this case; they all look like legalistic sophistry to me more than anything else. I think the fundamental problem is that the CFAA is bad law, which means that there will be reasonable arguments on both sides any time it comes up in a court case. What should really happen is that the law should be changed.

jdmichal 5y ago
> What should really happen is that the law should be changed. And the way to make that happen is by limiting the scope of the law as much as possible, in order to force law makers to rewrite it. Which is what has happened here. If law makers did intend the rejected interpretation, then they should rewrite it to clarify such.
- pdonis 5y ago
  > the way to make that happen is by limiting the scope of the law as much as possible, in order to force law makers to rewrite it. I doubt that will actually happen, though. Our system basically assumes that laws will be written to be vague and ambiguous, and that courts will clarify the interpretation over time. I don't think this is a very good way to run things, but it seems to be the way we've settled on.
  - jdmichal 5y ago
    Maybe. But it's a pretty strong component of the interaction between legislature and judiciary. Ambiguity should be resolved to make fewer things criminal. And then the legislature can disambiguate if they deem it important enough business to do so. https://en.wikipedia.org/wiki/Rule_of_lenity https://en.wikipedia.org/wiki/Rule_of_lenity

libeclipse 5y ago

They charged Swartz under many more things than just the Computer Fraud and Abuse Act. Just check out the list here: https://en.wikipedia.org/wiki/Aaron_Swartz#Arrest_and_prosecution https://en.wikipedia.org/wiki/Aaron_Swartz#Arrest_and_prosec... - two state charges of breaking and entering with intent to commit a felony - wire fraud, computer fraud, unlawfully obtaining information from a protected computer, and recklessly damaging a protected computer - breaking and entering with intent, grand larceny, and unauthorized access to a computer network - federal prosecutors filed a superseding indictment adding nine more felony counts, which increased Swartz's maximum criminal exposure to 50 years of imprisonment and $1 million in fines

walrus01 5y ago

> measure was "unauthorized" While I agree with your assessment, it was not just "unauthorized", it was straight up corruption. Making an agreement to accept a $5000 cash payment from some sketchy dude to look up a third party's accessible-to-law-enforcement only details. The guy should have been prosecuted under various existing corruption statutes and not the CFAA.

deleted 5y ago

[deleted]

zucker42 5y ago

I agree with this comment. In my opinion there should be stronger laws regarding the misuse of police power, but those can be implemented at the state level, the extension of the CFAA to that is dangerous. One key point is this document: > The Government’s interpretation of the “exceeds authorized access” clause would attach criminal penalties to a breathtaking amount of commonplace computer activity. For instance, employers commonly state that computers and electronic devices can be used only for business purposes. On the Government’s reading, an employee who sends a personal e-mail or reads the news using a work computer has violated the CFAA. The Government speculates that other provisions might limit its prosecutorial power, but its charging practice and policy indicate otherwise.