8 ms·

This ruling is really confusing for me. So I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. Yet so m

This ruling is really confusing for me. So I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. Yet so many people I usually agree with (SCOTUS judges, EFF, privacy lawyers) are all calling this a win. Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it. In other words, lets say I work at a gay hookup website and they grant me access to their production database as part of my job. If I start selling off information about user to third parties (say journalists), how can that be legal? Aside, I do understand and agree with the argument allowing for spidering and screen scrapping. Like, if I buy a subscription to an online parts catalog, I should be able to use a bot to access that data in the same ways a human could.

TazeTSchnitzel 5y ago
> To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system That is not the meaning of the ruling. Nothing precludes trying someone for other crimes.
0110101001 5y ago
The guy was also convicted of wire fraud and bribery. Those charges were not at question in this decision. This decision only says that looking up records you have access to is not hacking.
JoeCortopassi 5y ago
In your example, the information you sell would still be illegal, it just wouldn't have the added crime of hacking aka "unauthorized access" attached to it. People are calling this a win because the CFAA, as it used to be interpreted, would have had you potentially charged for changing the url of this post from 'https://news.ycombinator.com/item?id=27389500 https://news.ycombinator.com/item?id=27389500' to this 'https://news.ycombinator.com/item?id=waffles https://news.ycombinator.com/item?id=waffles'. This allowed cops/feds to charge you with crazy high penalties if they really wanted to make you sweat, see Aaron Schwartz Some of the most memorable SCOTUS cases had less than noble test cases (ever hear of Miranda rights? https://en.wikipedia.org/wiki/Miranda_v._Arizona https://en.wikipedia.org/wiki/Miranda_v._Arizona). SCOTUS isn't deciding if the defendant is a dirt bag or not, just if the very specific law is valid/applied correctly
walshemj 5y ago
Id agree all this means a bent cop got off on a technicality and the tabloid press get a free pass.
- quickthrowman 5y ago
  He was still convicted of wire fraud and bribery, how is that a free pass?
  - walshemj 5y ago
    The tabloids can dodge some of the consequences see teh hacked off campaign in the UK
deleted 5y ago
[deleted]
ghaff 5y ago
The majority are happy to see that minor or even trivial access of things people aren't "supposed" to look at--even though they have access to systems--are no longer CFAA violations. The assumption is that if it isn't trivial they're probably violating some other law or at least doing something they'll be fired for. That said, I have sympathy for the dissent as well which essentially argues that the majority is drawing an awful fine distinction here. i.e. so long as you're OK to access a system for some purpose, you're fine so far as the CFAA is concerned.
- LocalPCGuy 5y ago
  > so long as you're OK to access a system for some purpose, you're fine so far as the CFAA is concerned This is a pretty gross simplification of the position by the majority. I get it was an example and maybe a bit exaggerated, but wanted to point this out. They even specifically said that you have to have the specific access to the information you are retrieving - the example (paraphrased) was if you have access to folder X, but not folder Y, and you then access folder Y, you are now in violation. If anything, the minority was basically being, IMO, too trusting that people with the authority to bring these charges would be reasonable and exercise it in an unbiased and even manner.
  - ghaff 5y ago
    Fair enough. I was using "system" in the sense of collection of resources/information--not necessarily everything connected to it in some manner. I'm not unhappy with the result. I also think it draws a very narrow line that doesn't really exist in the law (which is why you see Thomas et al dissenting).
fron 5y ago
> then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it. They would not be criminally liable under CFAA, but they can absolutely be charged with other crimes in such a circumstance
ddlatham 5y ago
Perhaps it would be helpful to consider an offline analogy. Suppose there were no computers involved and all the information was stored in files in a locked room. Now Van Buren is given a key to access the filing room for his duties, and then uses his key to go in and look up the file on some license plate in exchange for money. Clearly, this is a terrible breach of trust and authority. It should be against policy. He should be fired. Likely there should also be criminal statutes about police or government employees selling or abusing government records. But he's not guilty of breaking and entering. He was given access to that data, even if this is not what he was supposed to be going in there for. As one of the justices noted, if merely misusing computer access that you were otherwise allowed to access were a criminal offense, then potentially "an employee sending a personal email or checking sports scores on a work device" could be criminal, rather than just breaking a company policy.
- foota 5y ago
  It seems to me like the issue here is that reasonable people disagree on where the boundary between work misconduct and criminal liability is, and that computers being involved are pushing that to the forefront in these kinds of cases.
  - bobthepanda 5y ago
    Also there is no reason that misconduct of this kind couldn’t be prosecuted under laws preventing similar breaches that aren’t digital in nature. Selling private data for bribes should be illegal whether or not it’s a database or a file cabinet.
    - deleted 5y ago
      [deleted]
  - ddlatham 5y ago
    I agree that defining where the boundary should be is tricky in practice, and it's a good point that this was hardly a unanimous decision, not to mention overruling the appealed ruling. On the other hand, the underlying law, the CFAA, is about more than just workplace issues like this issue. Interpreting it broadly could mean that violating some terms of use could be a criminal offense, and I am glad that the court avoided that interpretation. It's better having this law be more specific to the intent of criminalizing "hacking" and leaving other laws or policies to deal with how one might abuse computers or networks that one is otherwise entitled to access.
cbsmith 5y ago
> This ruling is really confusing for me. So I feel pretty strongly that what Van Buren did is a massive abuse of authority and it warrants punishment. I wouldn't disagree with your judgement here, but you wouldn't charge him with murder right? Neither should you charge him with hacking. > If I start selling off information about user to third parties (say journalists), how can that be legal? Well, by default it would be legal, except I imagine any employment contract would have a provision around privacy, disclosure, and trade secrets, etc. You'd be in violation of the contract, and since you made money from it, some form of fraud or similar would apply. The question is, would you consider that the same crime as someone without access to the production database breaking in and grabbing the data, and perhaps just giving it away for free (so they'd avoid committing a bunch of other criminal acts).
amelius 5y ago
> I should be able to use a bot to access that data in the same ways a human could. I don't think even this is something that follows naturally. For example, a human can sit next to the highway and write down license plates. However, it is still a crime if you use a computer to do the same (and perhaps sell a huge database containing this information).
- stachetoverlord 5y ago
  Where is this a crime? Dashcams are generally not illegal.
  - amelius 5y ago
    It becomes illegal when you make a database of license plates coupled to locations and times. And even more illegal when you publish a service for looking up this data.
billiam 5y ago
the decision is not about other laws for criminally misusing information, as in your example, it is about the fact that the CFAA is a bad law written by legislators who did not understand (and appeared to be afraid of) computers.
1vuio0pswjnm7 5y ago
"This ruling is really confusing to me. So I feel like what Van Buren did is a massive abuse of authority and it warrants punishment." The Supreme Court decision does not by itself exonerate Van Buren. It just remands the case to the lower court to decide again, taking into account the clarification of the CFAA's applicability. Van Buren could still be found guilty and punished, on other grounds. Just because some action involves a computer (database) and does not violate the CFAA does not necessarily mean it will not trigger potential culpability or liability under other criminal or civil law.
Miner49er 5y ago
If ruled the other way then basically everyone who works a desk job would be breaking the CFAA daily. Let me explain. If an employer only allowed employees to use their work computers for work (I assume most do, at least officially) as soon as an employee does anything personal on it (checks FB, checks HN, etc) even if on lunch break, they have exceeded their authorization, broken the law under the CFAA, and face up to 10 years in prison.
- WillPostForFood 5y ago
  That's incorrect. If you read the full statute, it has to be unauthorized access combined with some sort of theft of data, or access of governmental records. It wouldn't apply to browsing public sites. The specific subsection that was applied to Can Buren lays out three cases. Unauthorized access plus obtaining: (A)information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602(n) [1] of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.); (B)information from any department or agency of the United States; or (C)information from any protected computer;
  - rurabe 5y ago
    Thanks for posting this, I didn't realize there was a such a tangle of definitions as to what was accessed. That said, doesn't this pretty much include anything on the web? (a)Whoever— (2)intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (C)information from any protected computer; where a "protected computer" is: (e)As used in this section— (2) the term “protected computer” means a computer— (B) which is used in or affecting interstate or foreign commerce or communication seems like that would catch an awful lot of webservers.
olliej 5y ago
All the ruling says is that he didn’t violate the CFAA. It doesn’t say anything about bribery laws, selling government information, etc It is typical for a prosecution to include every charge possible. In this case they included the CFAA, and the Supreme Court said that particular charge was an invalid application of that particular law. It has no effect on any other charges, and no effect on any other laws.
LocalPCGuy 5y ago
It isn't saying it is legal, just that it doesn't run afoul of the CFAA and become a federal computer hacking crime. There very well be other laws and repercussions, whether at different levels, like State, or being fired, etc. It is refreshing because it doesn't put the risk of federal criminal prosecution at the whim of how an employer writes their policies.
belorn 5y ago
My understanding of the issue is that the prosecutor chose to use the CFAA rather than going after the real crime because of the circumstances. The accused in the case was caught in a sting operation. The police created a fake situation where they pretended to have an undercover agent, and tries to see if the accused would interfere with the case. He did. The prosecutor however did not charge the accused over obstruction of justice, but rather CFAA and hacking charges. I would guess that the reason is that the prosecutor thought it was easier than charging someone with interfering with a fake case. From what I understand, courts and judges do not like it when either side try to be clever. CFAA is not a tool to be used when the prosecutor want to avoid a more difficult case, and so it needed to be limited in scope.
babypuncher 5y ago
What he did was despicable and a grotesque abuse of his position, but it had nothing to do with hacking. The prosecutors decided to charge him under the CFAA because the data he sold for money was stored in a computer system. Van Buren accessed data he was authorized to access, using his own perfectly valid credentials. Because of this, the Supreme Court says it is not a violation of the Computer Fraud and Abuse act. They say that a person cannot be charged under the CFAA just because the crime they committed involved a computer.
- monocasa 5y ago
  Well, van Buren was convicted of a felony wire fraud charge as well with an equal length concurrently served sentence as the CFAA charge. So there was another crime we could charge him with, and we did successfully. The only difference is the lack of a CFAA charge on his record and some good case law about what the CFAA actually means so that hopefully it'll only be pushed against true computer crimes rather than crimes that happen to involve a computer.
monocasa 5y ago
Van Buren was also convicted of wire fraud for the same act, with a concurrent prison sentence with the CFAA count of the same length (18 months). So at least in this case he's getting the same punishment either way for his actions. Reducing the scope of the CFAA in case law just means that we take the teeth out of a overused and honestly crappy law that's ruined lives without reason to.
caturopath 5y ago
Van Buren clearly committed a heinous act and should be punished. The issue is that this is a hacking statue. He didn't hack into the system, he just used it in a bad way. The punishment should be the same if he got it from a filing cabinet he had the keys to. The takeaway isn't "If you have access, everything you do is legal" -- not for computers, not for filing cabinets.
dragonwriter 5y ago
> So I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. Yet so many people I usually agree with (SCOTUS judges, EFF, privacy lawyers) are all calling this a win. Whether Van Buren deserves punishment is a separate question from whether the legal theory the DoJ sought to use to get him punished was proper. > Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it. No, it doesn't. This is not a finding that the activity is Constitutionally protected, or even non-criminal in any broad sense, but that it is not within the scope of the criminal provisions of the CFAA, which is a win, because the interpretation of the CFAA necessary to make it applicable is ludicrously broad. > In other words, lets say I work at a gay hookup website and they grant me access to their production database as part of my job. If I start selling off information about user to third parties (say journalists), how can that be legal It shouldn't be, but that doesn’t justify abusing the CFAA into a blank prosecutorial check.
- tialaramex 5y ago
  > Whether Van Buren deserves punishment is a separate question from whether the legal theory the DoJ sought to use to get him punished was proper. Exactly. https://www.youtube.com/watch?v=PDBiLT3LASk https://www.youtube.com/watch?v=PDBiLT3LASk "That man's bad" / "There's no law against that" "Whilst you talk he's gone" / "And go he should, if he were the devil himself until he broke the law".
rurabe 5y ago
The CFAA is a law about how you access systems, so this ruling defines "authorization" under the CFAA as "had legitimate access to this system" only. There are many other laws that you can still be charged with that govern what you access, irrespective of how, ie copyright, child porn, confidential information. The people who view this as a win are worried that if "authorization" is defined as "against any rule, made by anyone" then the CFAA could be used to criminalize almost anything online. Note that restriction of the CFAA does not let you off the hook of other laws. The people who worry about this are worried that judges had to use a fair bit of extrapolation and guessing as to the intent and effects of the law because the wording is pretty vague, and probably problematic for internet activity if interpreted very narrowly.
willseth 5y ago
> Am I missing something? ... it warrants punishment. The decision does not prevent punishment. It narrows the scope of how the CFAA can be applied. Had it been interpreted as broadly as the government asked, terms of service violations would be open to Federal prosecution. The EFF article lays out some particularly troublesome implications, like criminalizing the use of your work computer for personal matters. > If I start selling off information about user to third parties (say journalists), how can that be legal? It's not. The decision simply states that because you were given access, you can't be charged specifically for hacking. You would still on the hook for stealing and selling the data.
cletus 5y ago
Just because someone did something wrong and should be punished doesn't mean they committed murder. Just because a computer was used doesn't mean it was "hacking". The Supreme Court essentially limited the scope of the CFAA to unauthorized access of a computer system. That is a good thing. The alternative is your employer could institute a policy change in what you can use internal systems for and you could find yourself on the wrong end of a CFAA "hacking" criminal prosecution. That's not hyperbole. On a side note, we once again find Thomas on the wrong side of history. The dissenters have gone well beyond what they might argue is strict textualism to simply supporting broad authoritarianism. Aaron Swartz is frequently brought up here as a prime example of prosecutorial overreach. For example, he was charged with "hacking" with the (then) interpretation of the CFAA, which then compounded to other charges, like breaking and entering to commit a felony (CFAA "hacking" was that felony). We need less not more overbroad legislation.
walrus01 5y ago
> So I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. After reading the background info in the Supreme Court decision PFD... Agreeing to accept a $5000 cash bribe from some sketchy dude for information available only to law enforcement, undoubtedly falls within many existing anti-corruption laws that he could have been prosecuted under.
kragen 5y ago
The opinion doesn't mean they can't be held criminally liable for anything they do with access to that system, just that the CFAA isn't the law that is broken. That means that the punishment or restitution imposed, if any, has to do with some other harm that was caused, over and above the mere fact of, for example, your "intrusion" into Facebook's computers by posting a photo of a cartoon character and thus violating Facebook's terms of service. In your gay-hookup-website example, you might be civilly or criminally liable in various states of the US under a variety of laws that have nothing to do with computers. For example: · an invasion-of-privacy tort or negligent-infliction-of-emotional-distress tort due to publicly disclosing private facts about the plaintiffs; · a breach-of-contract tort or tortious-interference tort or negligence due to damaging your employer's business relations with the users (especially if you signed an NDA); · a misappropriation-of-trade-secrets tort arguing that the users' information is a "trade secret" of the employer; · a breach-of-fiduciary-duty tort claiming that if someone was going to get paid for the users' information it should have been your employer and not you; · a breach-of-confidence tort claiming that your employer owed the users a duty of confidentiality, and you correspondingly owed it to your employer, and that you breached it by selling the data to journalists; or · a conversion tort because you used the computer system in a way you were not authorized to use it. (Also, the employer can probably recover whatever you were paid with an unjust-enrichment tort.) Aside from being a tort, trade-secret theft is also a federal crime, so if your employer can persuade a prosecutor to go after you, they may be able to get you jail time. IANAL but I think the trade-secret case here is kind of weak, because in your scenario I think the journalist isn't running a competing gay-hookup website, so they aren't competing with your employer. There's also a crime of "criminal conversion", which I think is also kind of a stretch, since the employer can still use the computer system. However, there was a civil conversion award for conversion of computer programs in Alabama in 01978, and another for conversion of personal information in New York in 02007: https://www.law.cornell.edu/nyctap/I07_0029.htm https://www.law.cornell.edu/nyctap/I07_0029.htm and in Oregon in 02013: https://www.tradesecretslaw.com/wp-content/uploads/sites/232/2013/08/Jacobsen-v.-Gaylor-Order3.pdf https://www.tradesecretslaw.com/wp-content/uploads/sites/232.... Such innovations are still controversial and not widely accepted: https://www.nortonrosefulbright.com/-/media/files/nrf/nrfweb/knowledge-pdfs/the-slow-expansion-of-conversion-claims-to-cover-intangible-property.pdf?la=en-us&revision=bda98815-97c8-4761-b331-6429a0f8e9a4 https://www.nortonrosefulbright.com/-/media/files/nrf/nrfweb...)
fnordprefect 5y ago
> Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it. What you are missing is that you are assuming that the CFAA is the only means by which Van Buren should be punished. So you are assuming that either the CFAA covers this abuse, or he gets off completely free. The CFAA isn't the only means to deal with his conduct. Although it doesn't apply, he is still liable to be punished under whatever regime he was given access to it. In simplified form: He was granted access to the system pursuant to his employment - ie he was able to log into it, whereas the average citizen can't. Whatever conditions are applicable to that grant are the ones to apply when he abuses that access (eg if the policy says "you can only access this for these purposes, or you will be fired" then if he accesses it for a different purpose, they can fire him). That is quite separate from the CFAA. The CFAA is a parallel source of obligations, and is part of the criminal law. Just because Van Buren breached the terms on which his employer let him access the database doesn't necessarily mean he committed a crime as well. What SCOTUS did was say that the criminal law provision essentially deals with the "technical" side of access: * if you get into a computer that you have no access to (ie hacking into it), you breach the relevant section. * if you are authorised by the operator to have the technical means to access to certain info in the computer (eg permissions), and you do something to access other material, you breach the section (eg escalation of privileges) * if you have the technical means to access the computer (eg log/password) and you access material that is permitted under those means (ie the user account), but you are not authorised to have that means of access (ie stolen login credentials), you also breach the section. The problem with the interoperation that SCOTUS rejected was that under EULAs, the provider could essentially say "you can use our systems to log in and view information. But if we decide we don't like you, or you haven't paid your bill, or if you decide you are going to vote for politician X in the upcoming election, then if you actually view any information while you are logged in, you breach the act and commit a crime" The rejected interpretation said: "authorised does not just mean you have been provided with the technical means to access the information, but also any additional conditions put on your use of the technical means by the person who granted it, which may change at any time" (eg change of policy, what is going through the user's mind) So the answer to your observation: > I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. is: it is exactly that. But it is punishment to be delivered via the process granting him the access to the information (ie whatever sanctions apply to violation of departmental policy). What he did was a breach of that policy, leaving him open to whatever sanctions are provided in it. But it is not also a crime under the CFAA.
austincheney 5y ago
Van Buren violated policy. He should have been terminated. Van Buren was prosecuted for a criminal act not narrowly reflected by the law he was prosecuted against. The SC majority opinion mentioned exactly this. > Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it. Yes, you are confusing a policy violation for something more grand. I suspect most people are confused on this matter due to a selection bias favoring criminality for a violation of public trust.

TazeTSchnitzel 5y ago

> To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system That is not the meaning of the ruling. Nothing precludes trying someone for other crimes.

0110101001 5y ago

The guy was also convicted of wire fraud and bribery. Those charges were not at question in this decision. This decision only says that looking up records you have access to is not hacking.

JoeCortopassi 5y ago

In your example, the information you sell would still be illegal, it just wouldn't have the added crime of hacking aka "unauthorized access" attached to it. People are calling this a win because the CFAA, as it used to be interpreted, would have had you potentially charged for changing the url of this post from 'https://news.ycombinator.com/item?id=27389500 https://news.ycombinator.com/item?id=27389500' to this 'https://news.ycombinator.com/item?id=waffles https://news.ycombinator.com/item?id=waffles'. This allowed cops/feds to charge you with crazy high penalties if they really wanted to make you sweat, see Aaron Schwartz Some of the most memorable SCOTUS cases had less than noble test cases (ever hear of Miranda rights? https://en.wikipedia.org/wiki/Miranda_v._Arizona https://en.wikipedia.org/wiki/Miranda_v._Arizona). SCOTUS isn't deciding if the defendant is a dirt bag or not, just if the very specific law is valid/applied correctly

walshemj 5y ago

Id agree all this means a bent cop got off on a technicality and the tabloid press get a free pass.

quickthrowman 5y ago
He was still convicted of wire fraud and bribery, how is that a free pass?
- walshemj 5y ago
  The tabloids can dodge some of the consequences see teh hacked off campaign in the UK

deleted 5y ago

[deleted]

ghaff 5y ago

The majority are happy to see that minor or even trivial access of things people aren't "supposed" to look at--even though they have access to systems--are no longer CFAA violations. The assumption is that if it isn't trivial they're probably violating some other law or at least doing something they'll be fired for. That said, I have sympathy for the dissent as well which essentially argues that the majority is drawing an awful fine distinction here. i.e. so long as you're OK to access a system for some purpose, you're fine so far as the CFAA is concerned.

LocalPCGuy 5y ago
> so long as you're OK to access a system for some purpose, you're fine so far as the CFAA is concerned This is a pretty gross simplification of the position by the majority. I get it was an example and maybe a bit exaggerated, but wanted to point this out. They even specifically said that you have to have the specific access to the information you are retrieving - the example (paraphrased) was if you have access to folder X, but not folder Y, and you then access folder Y, you are now in violation. If anything, the minority was basically being, IMO, too trusting that people with the authority to bring these charges would be reasonable and exercise it in an unbiased and even manner.
- ghaff 5y ago
  Fair enough. I was using "system" in the sense of collection of resources/information--not necessarily everything connected to it in some manner. I'm not unhappy with the result. I also think it draws a very narrow line that doesn't really exist in the law (which is why you see Thomas et al dissenting).

fron 5y ago

> then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it. They would not be criminally liable under CFAA, but they can absolutely be charged with other crimes in such a circumstance

ddlatham 5y ago

Perhaps it would be helpful to consider an offline analogy. Suppose there were no computers involved and all the information was stored in files in a locked room. Now Van Buren is given a key to access the filing room for his duties, and then uses his key to go in and look up the file on some license plate in exchange for money. Clearly, this is a terrible breach of trust and authority. It should be against policy. He should be fired. Likely there should also be criminal statutes about police or government employees selling or abusing government records. But he's not guilty of breaking and entering. He was given access to that data, even if this is not what he was supposed to be going in there for. As one of the justices noted, if merely misusing computer access that you were otherwise allowed to access were a criminal offense, then potentially "an employee sending a personal email or checking sports scores on a work device" could be criminal, rather than just breaking a company policy.

foota 5y ago
It seems to me like the issue here is that reasonable people disagree on where the boundary between work misconduct and criminal liability is, and that computers being involved are pushing that to the forefront in these kinds of cases.
- bobthepanda 5y ago
  Also there is no reason that misconduct of this kind couldn’t be prosecuted under laws preventing similar breaches that aren’t digital in nature. Selling private data for bribes should be illegal whether or not it’s a database or a file cabinet.
  - deleted 5y ago
    [deleted]
- ddlatham 5y ago
  I agree that defining where the boundary should be is tricky in practice, and it's a good point that this was hardly a unanimous decision, not to mention overruling the appealed ruling. On the other hand, the underlying law, the CFAA, is about more than just workplace issues like this issue. Interpreting it broadly could mean that violating some terms of use could be a criminal offense, and I am glad that the court avoided that interpretation. It's better having this law be more specific to the intent of criminalizing "hacking" and leaving other laws or policies to deal with how one might abuse computers or networks that one is otherwise entitled to access.

cbsmith 5y ago

> This ruling is really confusing for me. So I feel pretty strongly that what Van Buren did is a massive abuse of authority and it warrants punishment. I wouldn't disagree with your judgement here, but you wouldn't charge him with murder right? Neither should you charge him with hacking. > If I start selling off information about user to third parties (say journalists), how can that be legal? Well, by default it would be legal, except I imagine any employment contract would have a provision around privacy, disclosure, and trade secrets, etc. You'd be in violation of the contract, and since you made money from it, some form of fraud or similar would apply. The question is, would you consider that the same crime as someone without access to the production database breaking in and grabbing the data, and perhaps just giving it away for free (so they'd avoid committing a bunch of other criminal acts).

amelius 5y ago

> I should be able to use a bot to access that data in the same ways a human could. I don't think even this is something that follows naturally. For example, a human can sit next to the highway and write down license plates. However, it is still a crime if you use a computer to do the same (and perhaps sell a huge database containing this information).

stachetoverlord 5y ago
Where is this a crime? Dashcams are generally not illegal.
- amelius 5y ago
  It becomes illegal when you make a database of license plates coupled to locations and times. And even more illegal when you publish a service for looking up this data.

billiam 5y ago

the decision is not about other laws for criminally misusing information, as in your example, it is about the fact that the CFAA is a bad law written by legislators who did not understand (and appeared to be afraid of) computers.

1vuio0pswjnm7 5y ago

"This ruling is really confusing to me. So I feel like what Van Buren did is a massive abuse of authority and it warrants punishment." The Supreme Court decision does not by itself exonerate Van Buren. It just remands the case to the lower court to decide again, taking into account the clarification of the CFAA's applicability. Van Buren could still be found guilty and punished, on other grounds. Just because some action involves a computer (database) and does not violate the CFAA does not necessarily mean it will not trigger potential culpability or liability under other criminal or civil law.

Miner49er 5y ago

If ruled the other way then basically everyone who works a desk job would be breaking the CFAA daily. Let me explain. If an employer only allowed employees to use their work computers for work (I assume most do, at least officially) as soon as an employee does anything personal on it (checks FB, checks HN, etc) even if on lunch break, they have exceeded their authorization, broken the law under the CFAA, and face up to 10 years in prison.

WillPostForFood 5y ago
That's incorrect. If you read the full statute, it has to be unauthorized access combined with some sort of theft of data, or access of governmental records. It wouldn't apply to browsing public sites. The specific subsection that was applied to Can Buren lays out three cases. Unauthorized access plus obtaining: (A)information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602(n) [1] of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.); (B)information from any department or agency of the United States; or (C)information from any protected computer;
- rurabe 5y ago
  Thanks for posting this, I didn't realize there was a such a tangle of definitions as to what was accessed. That said, doesn't this pretty much include anything on the web? (a)Whoever— (2)intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (C)information from any protected computer; where a "protected computer" is: (e)As used in this section— (2) the term “protected computer” means a computer— (B) which is used in or affecting interstate or foreign commerce or communication seems like that would catch an awful lot of webservers.

olliej 5y ago

All the ruling says is that he didn’t violate the CFAA. It doesn’t say anything about bribery laws, selling government information, etc It is typical for a prosecution to include every charge possible. In this case they included the CFAA, and the Supreme Court said that particular charge was an invalid application of that particular law. It has no effect on any other charges, and no effect on any other laws.

LocalPCGuy 5y ago

It isn't saying it is legal, just that it doesn't run afoul of the CFAA and become a federal computer hacking crime. There very well be other laws and repercussions, whether at different levels, like State, or being fired, etc. It is refreshing because it doesn't put the risk of federal criminal prosecution at the whim of how an employer writes their policies.

belorn 5y ago

My understanding of the issue is that the prosecutor chose to use the CFAA rather than going after the real crime because of the circumstances. The accused in the case was caught in a sting operation. The police created a fake situation where they pretended to have an undercover agent, and tries to see if the accused would interfere with the case. He did. The prosecutor however did not charge the accused over obstruction of justice, but rather CFAA and hacking charges. I would guess that the reason is that the prosecutor thought it was easier than charging someone with interfering with a fake case. From what I understand, courts and judges do not like it when either side try to be clever. CFAA is not a tool to be used when the prosecutor want to avoid a more difficult case, and so it needed to be limited in scope.

babypuncher 5y ago

What he did was despicable and a grotesque abuse of his position, but it had nothing to do with hacking. The prosecutors decided to charge him under the CFAA because the data he sold for money was stored in a computer system. Van Buren accessed data he was authorized to access, using his own perfectly valid credentials. Because of this, the Supreme Court says it is not a violation of the Computer Fraud and Abuse act. They say that a person cannot be charged under the CFAA just because the crime they committed involved a computer.

monocasa 5y ago
Well, van Buren was convicted of a felony wire fraud charge as well with an equal length concurrently served sentence as the CFAA charge. So there was another crime we could charge him with, and we did successfully. The only difference is the lack of a CFAA charge on his record and some good case law about what the CFAA actually means so that hopefully it'll only be pushed against true computer crimes rather than crimes that happen to involve a computer.

monocasa 5y ago

Van Buren was also convicted of wire fraud for the same act, with a concurrent prison sentence with the CFAA count of the same length (18 months). So at least in this case he's getting the same punishment either way for his actions. Reducing the scope of the CFAA in case law just means that we take the teeth out of a overused and honestly crappy law that's ruined lives without reason to.

caturopath 5y ago

Van Buren clearly committed a heinous act and should be punished. The issue is that this is a hacking statue. He didn't hack into the system, he just used it in a bad way. The punishment should be the same if he got it from a filing cabinet he had the keys to. The takeaway isn't "If you have access, everything you do is legal" -- not for computers, not for filing cabinets.

dragonwriter 5y ago

> So I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. Yet so many people I usually agree with (SCOTUS judges, EFF, privacy lawyers) are all calling this a win. Whether Van Buren deserves punishment is a separate question from whether the legal theory the DoJ sought to use to get him punished was proper. > Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it. No, it doesn't. This is not a finding that the activity is Constitutionally protected, or even non-criminal in any broad sense, but that it is not within the scope of the criminal provisions of the CFAA, which is a win, because the interpretation of the CFAA necessary to make it applicable is ludicrously broad. > In other words, lets say I work at a gay hookup website and they grant me access to their production database as part of my job. If I start selling off information about user to third parties (say journalists), how can that be legal It shouldn't be, but that doesn’t justify abusing the CFAA into a blank prosecutorial check.

tialaramex 5y ago
> Whether Van Buren deserves punishment is a separate question from whether the legal theory the DoJ sought to use to get him punished was proper. Exactly. https://www.youtube.com/watch?v=PDBiLT3LASk https://www.youtube.com/watch?v=PDBiLT3LASk "That man's bad" / "There's no law against that" "Whilst you talk he's gone" / "And go he should, if he were the devil himself until he broke the law".

rurabe 5y ago

The CFAA is a law about how you access systems, so this ruling defines "authorization" under the CFAA as "had legitimate access to this system" only. There are many other laws that you can still be charged with that govern what you access, irrespective of how, ie copyright, child porn, confidential information. The people who view this as a win are worried that if "authorization" is defined as "against any rule, made by anyone" then the CFAA could be used to criminalize almost anything online. Note that restriction of the CFAA does not let you off the hook of other laws. The people who worry about this are worried that judges had to use a fair bit of extrapolation and guessing as to the intent and effects of the law because the wording is pretty vague, and probably problematic for internet activity if interpreted very narrowly.

willseth 5y ago

> Am I missing something? ... it warrants punishment. The decision does not prevent punishment. It narrows the scope of how the CFAA can be applied. Had it been interpreted as broadly as the government asked, terms of service violations would be open to Federal prosecution. The EFF article lays out some particularly troublesome implications, like criminalizing the use of your work computer for personal matters. > If I start selling off information about user to third parties (say journalists), how can that be legal? It's not. The decision simply states that because you were given access, you can't be charged specifically for hacking. You would still on the hook for stealing and selling the data.

cletus 5y ago

Just because someone did something wrong and should be punished doesn't mean they committed murder. Just because a computer was used doesn't mean it was "hacking". The Supreme Court essentially limited the scope of the CFAA to unauthorized access of a computer system. That is a good thing. The alternative is your employer could institute a policy change in what you can use internal systems for and you could find yourself on the wrong end of a CFAA "hacking" criminal prosecution. That's not hyperbole. On a side note, we once again find Thomas on the wrong side of history. The dissenters have gone well beyond what they might argue is strict textualism to simply supporting broad authoritarianism. Aaron Swartz is frequently brought up here as a prime example of prosecutorial overreach. For example, he was charged with "hacking" with the (then) interpretation of the CFAA, which then compounded to other charges, like breaking and entering to commit a felony (CFAA "hacking" was that felony). We need less not more overbroad legislation.

walrus01 5y ago

> So I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. After reading the background info in the Supreme Court decision PFD... Agreeing to accept a $5000 cash bribe from some sketchy dude for information available only to law enforcement, undoubtedly falls within many existing anti-corruption laws that he could have been prosecuted under.

kragen 5y ago

The opinion doesn't mean they can't be held criminally liable for anything they do with access to that system, just that the CFAA isn't the law that is broken. That means that the punishment or restitution imposed, if any, has to do with some other harm that was caused, over and above the mere fact of, for example, your "intrusion" into Facebook's computers by posting a photo of a cartoon character and thus violating Facebook's terms of service. In your gay-hookup-website example, you might be civilly or criminally liable in various states of the US under a variety of laws that have nothing to do with computers. For example: · an invasion-of-privacy tort or negligent-infliction-of-emotional-distress tort due to publicly disclosing private facts about the plaintiffs; · a breach-of-contract tort or tortious-interference tort or negligence due to damaging your employer's business relations with the users (especially if you signed an NDA); · a misappropriation-of-trade-secrets tort arguing that the users' information is a "trade secret" of the employer; · a breach-of-fiduciary-duty tort claiming that if someone was going to get paid for the users' information it should have been your employer and not you; · a breach-of-confidence tort claiming that your employer owed the users a duty of confidentiality, and you correspondingly owed it to your employer, and that you breached it by selling the data to journalists; or · a conversion tort because you used the computer system in a way you were not authorized to use it. (Also, the employer can probably recover whatever you were paid with an unjust-enrichment tort.) Aside from being a tort, trade-secret theft is also a federal crime, so if your employer can persuade a prosecutor to go after you, they may be able to get you jail time. IANAL but I think the trade-secret case here is kind of weak, because in your scenario I think the journalist isn't running a competing gay-hookup website, so they aren't competing with your employer. There's also a crime of "criminal conversion", which I think is also kind of a stretch, since the employer can still use the computer system. However, there was a civil conversion award for conversion of computer programs in Alabama in 01978, and another for conversion of personal information in New York in 02007: https://www.law.cornell.edu/nyctap/I07_0029.htm https://www.law.cornell.edu/nyctap/I07_0029.htm and in Oregon in 02013: https://www.tradesecretslaw.com/wp-content/uploads/sites/232/2013/08/Jacobsen-v.-Gaylor-Order3.pdf https://www.tradesecretslaw.com/wp-content/uploads/sites/232.... Such innovations are still controversial and not widely accepted: https://www.nortonrosefulbright.com/-/media/files/nrf/nrfweb/knowledge-pdfs/the-slow-expansion-of-conversion-claims-to-cover-intangible-property.pdf?la=en-us&revision=bda98815-97c8-4761-b331-6429a0f8e9a4 https://www.nortonrosefulbright.com/-/media/files/nrf/nrfweb...)

fnordprefect 5y ago

> Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it. What you are missing is that you are assuming that the CFAA is the only means by which Van Buren should be punished. So you are assuming that either the CFAA covers this abuse, or he gets off completely free. The CFAA isn't the only means to deal with his conduct. Although it doesn't apply, he is still liable to be punished under whatever regime he was given access to it. In simplified form: He was granted access to the system pursuant to his employment - ie he was able to log into it, whereas the average citizen can't. Whatever conditions are applicable to that grant are the ones to apply when he abuses that access (eg if the policy says "you can only access this for these purposes, or you will be fired" then if he accesses it for a different purpose, they can fire him). That is quite separate from the CFAA. The CFAA is a parallel source of obligations, and is part of the criminal law. Just because Van Buren breached the terms on which his employer let him access the database doesn't necessarily mean he committed a crime as well. What SCOTUS did was say that the criminal law provision essentially deals with the "technical" side of access: * if you get into a computer that you have no access to (ie hacking into it), you breach the relevant section. * if you are authorised by the operator to have the technical means to access to certain info in the computer (eg permissions), and you do something to access other material, you breach the section (eg escalation of privileges) * if you have the technical means to access the computer (eg log/password) and you access material that is permitted under those means (ie the user account), but you are not authorised to have that means of access (ie stolen login credentials), you also breach the section. The problem with the interoperation that SCOTUS rejected was that under EULAs, the provider could essentially say "you can use our systems to log in and view information. But if we decide we don't like you, or you haven't paid your bill, or if you decide you are going to vote for politician X in the upcoming election, then if you actually view any information while you are logged in, you breach the act and commit a crime" The rejected interpretation said: "authorised does not just mean you have been provided with the technical means to access the information, but also any additional conditions put on your use of the technical means by the person who granted it, which may change at any time" (eg change of policy, what is going through the user's mind) So the answer to your observation: > I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. is: it is exactly that. But it is punishment to be delivered via the process granting him the access to the information (ie whatever sanctions apply to violation of departmental policy). What he did was a breach of that policy, leaving him open to whatever sanctions are provided in it. But it is not also a crime under the CFAA.

austincheney 5y ago

Van Buren violated policy. He should have been terminated. Van Buren was prosecuted for a criminal act not narrowly reflected by the law he was prosecuted against. The SC majority opinion mentioned exactly this. > Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it. Yes, you are confusing a policy violation for something more grand. I suspect most people are confused on this matter due to a selection bias favoring criminality for a violation of public trust.