Supreme Court Weighs In On Computer Fraud And Abuse Act – Criminal Law

To print this article, all you need to do is register or log in to Mondaq.com.

In Van Buren v. United States, No. 19-783 (June 3, 2021), the United States Supreme Court recently considered the meaning of the Computer Fraud and Abuse Act (CFAA) prohibition of “exceeding authorized access”.

A majority of six judges believed that a former Georgia police sergeant, Nathan Van Buren, did not break the CFAA when he violated the department’s policy that restricted the use of a police database for law enforcement purposes by selling one for money Performed license plate search. Van Buren was convicted under the CFAA, which imposed criminal and civil penalties for computer hacking and misuse of company computers by employees. Although Van Buren concerned a criminal conviction, the Court’s analysis also applies to civil claims under the CFAA.

background

The CFAA prohibits any person from accessing or violating a computer without authorization, and “allows persons who are ‘harmed’ or ‘lost’ as a result of CFAA violations” to seek civil indemnity and fair remedies. According to CFAA, 18 USC § 1030 (e) (6), “beyond authorized access” means “with an authorization to access a computer and to use that access to obtain or change information on the computer that the authorized person can access is not allowed to receive or change. “

The federal government charged Van Buren with violating the CFAA, a jury convicted him on the indictment, and a district court sentenced Van Buren to 18 months in prison for using the law enforcement database for personal purposes, in violation of Ministry of Politics rules. Van Buren appealed his conviction to the Eleventh District Court of Appeals and, ultimately, the Supreme Court, arguing that the CFAA’s phrase “exceeding authorized access” should apply only to those employees “receiving information on which you are entitled Computer can access “. does not extend to those who abuse the access they otherwise have. “The Supreme Court found that although several circles had approved Van Buren’s interpretation of the CFAA, four, including the Eleventh Circle Court of Appeals, which upheld his conviction, “Ha[d] taken a broader perspective. “

Judge Amy Coney Barrett, who delivered the opinion of the Court, was supported by a majority by Judges Stephen G. Breyer, Sonia Sotomayor, Elena Kagan, Neil M. Gorsuch and Brett M. Kavanaugh, who supported the interpretation of the law by the Government largely rejected the law, focusing on the meaning of the language of the law “is not entitled to receive so”.

Analysis of the court

The ruling focused on the text of the CFAA itself to determine the meaning of “exceeding authorized access” and obtaining information to which an individual is “not entitled”. The court found that the latter phrase “is best read for information that a person is not authorized to use a computer to which they are authorized to access.” The court agreed to Van Buren’s “gates-up-or-down investigation” to analyze both types of violation of the law – via “without authorization” or “exceeding authorized access” in 18 USC § 1030 (a) ( 2) – and came to the conclusion: “A computer system can either be accessed or not, and certain areas within the system can or cannot be accessed.”

The court found that the legal barrier to exceeding authorized access “covers those who receive information from certain areas of the computer – such as files, folders or databases – that their computer access does not extend to.” The court admitted that Van Buren’s use of the law enforcement database was “for an improper purpose” and was against the department’s guidelines. However, this behavior did not constitute a violation of the CFAA’s ban on using authorized access “to obtain or change information in the computer that the authorized person is not authorized to access or change,” the court said.

The Court rejected the government’s broad view of the law that a person’s right to information depends on the manner or circumstances in which he received it. The Court found that this approach applied an “inconsistent” analysis to the two prohibitions it contained, while Van Buren’s “gates-up-or-down investigation” treated them uniformly. The court rejected the premise that obtaining information for personal purposes when in breach of a contract or policy was a violation of the law. Specifically, the Court found that such a view “would penalize a staggering level of everyday computer activity” and that violating an employer’s computer usage policy would turn “millions of otherwise law-abiding citizens … into criminals.” “The Court found that the government’s approach” would be arbitrary in assessing criminal liability. “

The central theses

The court concluded by clarifying that there was a breach of the CFAA and “a person exceeds authorized access” if they do [or she] Accesses a computer with authorization, but then receives information that is in certain areas of the computer – such as files, folders, or databases – that are inaccessible to him. “

Judge Clarence Thomas, along with Chief Justice John G. Roberts and Judge Samuel A. Alito, argued that the verdict contradicted the clear meaning of the law and the “fundamental tenets of property law” that “have long punished those.” who have the extent of the consent. “The interpretation of the majority would, in their opinion, be tantamount to declaring that a valet service that is allowed to drive a patron’s car can then use his access to the vehicle to take it” for a spin ” use.

According to Van Buren, employers may want to weigh the decision carefully and evaluate their own computer policies and restrictions on access to sensitive and confidential business information.

The content of this article is intended to provide general guidance on the subject. Expert advice should be sought regarding your specific circumstances.

POPULAR ARTICLES ON: United States Criminal Law

FTC says “show me the money”

Troutman Pepper Hamilton Sanders

On June 7, the Federal Trade Commission (FTC) announced a proposed settlement with MoviePass. And in an interesting twist, the FTC used the proposed settlement to announce a novel means of obtaining monetary relief.