I agree with you, it totally fails the gut check, but it is because the law is poorly written. The Supreme Court bailed out the lawmakers by winging it here. The minority opinion is the worse, but more accurate plain reading of the law.
I won't claim that test is perfect, but it's a lot clearer than the current standards and when I go through past cases, I don't see it coming to any indefensible conclusions.
Yes, that would agree with the majority holding in this case. It's important to note that even if they didn't violate the CFAA, they likely broke plenty of other laws and can be punished for that.
So this conduct absolutely deserves to be punished, just not under the CFAA.
I think the majority opinion is also the more accurate plain reading of the law. So, from my perspective, no bailing out is necessary. The gut check and the plain reading both seem to align.
Did he exceed authorized access? He did, and therefore he broke the plain reading of the law. The law should be better, and separate violating access controls from violation of access policy, but it doesn't.
He did not. He was given a level of authorization that he did not exceed.
The problem, again, is in the ambiguity of the word “authorized” that allows multiple plain readings.
To me, it’s absolutely plain that “authorized access” refers to system authorization (that is, what the computer tells the user their permissions are), and “exceeds authorized access” refers to bypassing the system authorization limits. That’s absolutely the plain reading to me.
To you, you read “authorization” as “policy authorization” (that is, where another human tells you what your permission levels are).
The fact is, there are multiple kinds of “authorization” involved in this case, which means different people can have different plain readings of the statute. While your reading seems obvious to you, it seems strained to me. My reading might be strained to you, but it’s obvious to me.
No, that’s not quite right.
*To you* the plain reading is what you say. To *other* people the plain reading is different.
I, for example, don’t think the plain reading of something typically involves taking the union of definitions for each word in the sentence. To me, most plain readings involve selecting the single most appropriate definition for a word based on the surrounding context.
My point is that there isn’t an objectively correct “plain reading”. You are not the arbiter of what a plain reading is, nor am I.
Would you agree that different people can read the same sentence and in good faith have a different understanding of what “the plain reading” is?
One of them is misusing a car that you gave them access to, the other one is stealing it.
ref. https://codes.findlaw.com/ny/penal-law/pen-sect-165-05.html
In other jurisdictions (like, say, New Hampshire), that same case falls into the definition of theft.
You accessed privileged information that you were explicitly not allowed. To me, asking you not to look at certain information is effectively the same as putting a password on it, then having you break it. In both cases, the intent of the owner is clear: do not access these files. And in both cases, the actions of the perpetrator very clearly disregard the owners intent.
Your example about accessing a website is not the same. It's pretty clear that the person going to new.ycombinator.com is not stealing or accessing privileged information. There have been separate rulings dealing with whether or not employees can use corporate equipment for personal reasons.
A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite.
Unless, of course, the only reason the court ruled in favor of this person was that they are a police officer. But I guess we have to wait until the FBI attempts to press charges against someone at Google selling personal details to third parties to find out.
No, this isn't what this means at all. This ruling just means you haven't committed a crime under the Computer Fraud and Abuse Act by accessing that data if you didn't "hack" to get access to it. Depending on the information you sold, you could've violated other laws and you definitely violated the Non-Disclosure agreement you signed with those companies.
For reference, the cop in this case had other convictions under wire fraud laws that weren't changed by this.
To me, they are not effectively the same at all. I see there being two different types of "authorization" at play. One is a mechanical authorization built into the computer systems (a password, for example). The other is a policy authorization, built into how I convey to you what is "allowed" on the system. They seem fundamentally different to me.
To 6 justices on the Supreme Court, they are not effectively the same thing either. To 3 justices, they are. The ambiguity of English is definitely annoying when we get into the nitty-gritty of laws!
> A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite.
That's simply not what this ruling holds. That would be an accurate summary of this ruling if and only if the CFAA were the only law that exists in the United States Code!
"Legal" is also an ambiguous word in this context. Such an activity may break other laws, or it may not. I'm not familiar with what other criminal liability may attach to such behavior. But that activity almost certainly would be a civil violation. I would potentially be able to sue Google/Humana/Tinder (though there's a chance their privacy policy already gives them the option to sell my information). And Google/Humana/Tinder could certainly sue the rogue employee for damages caused by such a sale.
If Google/Humana/Tinder wanted to go further to protect themselves from bad-acting employees, they could use actual access controls (instead of mere policy) to restrict the ability for employees to access such data and only give access to employees who need such access. While it's certainly not the thing a Supreme Court ruling should hinge on, it's a nice added bonus that this gives a further incentive for companies to implement actual least access control rather than just making it a policy.
I'm pretty sure the exact fact that Amazon did not appropriate restrict access in this way is one of the points being considered in the antitrust case. Specifically, that people who shouldn't have been able to, and who shouldn't have by policy, still could access seller data.
Such rulings are about different laws. The government's interpretation would criminalize violating a protected computer's terms-of-service regardless of whether it is part of a corporate intranet or an ordinary website on the Internet. And yes, the government has pursued criminals charges for violating a website's ToS; see United States v. Drew, 259 F.R.D. 449 (C.D. Cal. 2009).
>A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite.
As to Humana, it would likely be a criminal HIPAA violation.
That's not a realistic example because something like that would be covered by an NDA or alternatively, if in EU or California, by data policies.
I think the other judges have the better reading of the specific language of the text. Thomas, Alito, and Roberts don't even take their dissent on the interpretation offered by the Government, but have to craft their own—extremely broad—interpretation of "entitled".
Since I think the opinion (at least, the little bit of it that I've skimmed) makes a fairly compelling case around the majority's interpretation of the words "so" and "entitled" I won't rehash that here. But, if we back up to the purpose and intent of the legislation, I think this outcome also better aligns with that.
The CFAA was designed to curtain the unauthorized use of computers. To make it illegal for people to deliberately circumventing the security measures built into computers to obtain information or cause other harm. If I hand you a computer, tell you the password, and ask you to login to my computer and respond to an email for me, but then ask you not to look in the `Taxes` folder on the desktop should it be a felony for you to open the `Taxes` folder? That conceptually feels wrong to me. I have violated your trust, sure, but I haven't committed fraud, and I haven't abused any access control mechanisms on the computer.
Or another scenario: your work gives you a work computer, and has a paragraph in the employee handbook that says you are never allowed to visit news.ycombinator.com on the work computer. At some point while working at the company, you visit news.ycombinator.com on the work computer. Have you just committed a felony? You've "exceeded the authorized access", if you interpret "entitled" and "authorized" as broadly as Thomas, Alito, and Roberts seem to. Should that really be a felony?
That interpretation leads to such a massive broadening of felony criminal liability. It doesn't gut-check for me. That, combined with what I perceive as the better textual reading of the phrases "so" and "entitled", I have to disagree with you. I think the other 6 justices had the better argument at multiple levels.