This is a policy violation, and maybe that should be illegal in some way or have consequences. I'd be ok with that, but it's just not "exceed authorized access". The person in this case was authorized.
The idea that you could be authorized, but suddenly not because of a policy doesn't make sense to me and that's kinda weird because that seems right up Thomas's literal interpretation alley (come on Thomas, use it right for once).
Imagine Comcast changes a policy, and suddenly you're in violation of Computer Fraud and Abuse Act (CFAA).
Sure, and usually policy violations that matter do involve civil consequences (e.g. litigation to recover damages) but not handing out felonies or putting someone in prison for a decade+.
The Opinion says he “was charged with and convicted of honest-services wire fraud,” though that it was vacated in a separate holding [1].
[1] https://www.supremecourt.gov/opinions/20pdf/19-783_k53l.pdf
It also adds a lot more pressure on the person charged to take a plea deal.
In my country any information related to a on-going investigation is automatically classified. Police are not allowed under the law to divulge to the press any such information.
That's to say: it'd be up to each state to create its own criminal laws regarding what they consider confidential information (if any) and make sure those laws are constitutional by explicitly writing them into the police officers' contracts. Much of the time, changing internal policy is all that states can realistically do because some federal statute or constitutional clause has supremacy - even something that's normally a fireable offense at a private business might run afoul of constitutional protections when done by a state government or agency.
I wonder if obstruction of justice can impact someone who has not made any agreement beforehand. A random pedestrian who tries to stop the police, in a public space where they otherwise would have a right to be, could still end up in jail if I understand the laws right. If they can do that with their physical body I suspect the same punishment can occur if they do that with their own first amendment voice given special circumstances and results of that speech.
It is however difficult for a random pedestrian to commit obstruction of justice out of accident, but a lot of actions done by a police officer would obstruct justice by the nature of their own work. Similar if a person were employed at a court, if they misbehaved erroneously, I would guess that it would carry a bit more legal risk just given the environment.
Nothing of this has anything to do with internal policy. Obstruction of justice is mostly about the intention and results.
If you have insider information on an ongoing investigation and you tell it to your buddy at the bar who doesn't care one bit about it and immediately forgets, that's not obstruction of justice because the speech itself isn't the criminal act. If you tell that same information to the suspects though, then that's obstruction of justice.
With classified (natsec) information, on the other hand, telling it to anyone who you're not absolutely certain has clearance to see it is a violation and could land you in jail for years if you get a bloodthirsty DA. (again, IANAL)
It is a bit of a special situation since the interfering was over a fake case, through the legal frame work of sting operations has always been a bit grey. It seems to me however that it flights clearly above that of first amendment rights. It seems simply that the prosecutor chose to go after CFAA because the case is about a sting case rather than a real one. Had the police officer interfered in a real case, where a criminal had been given information that obstructed police officers in their job, the case had been about that.
If that is true then the case has very little to do about internal policy decisions, exceeded permissions, unauthorized vs authorized users, employee contracts and so on. It is actually about sting operations and a prosecutor who attempts to bypass that discussion by using a law designed for a different purpose.
> In addition, I have been advised that any unauthorized disclosure of classified information by me may constitute a violation, or violations, of United States criminal laws, including the provisions of sections 641, 793, 794, 798, 952 and 1924, title 18, United States Code; the provisions of section 783(b}, title 50, United States Code; and the provisions of the Intelligence Identities Protection Act of 1982. I recognize that nothing in this Agreement constitutes a waiver by the United States of the right to prosecute me for any statutory violation
(again, IANAL and this is definitely not legal advice)
[1] https://www.gsa.gov/cdnstatic/SF312-13.pdf?forceDownload=1
Companies have gotten into trouble for doing research that might be used to build an atomic bomb, even though the research had other applications.
This is fundamentally different than e.g. the British approach, where the official secrets act applies to everyone whether or not they have signed it.
It's also the case that while the doctrine of born secret has not been tested in court, it is generally regarded as unconstitutional and likely to be struck down by the courts of they are given the opportunity.
Most of what I’ve read emphasized how controversial this is. As you said, there are severe first amendment implications.
Yet the law ignores these implications.
It is probably unconstitutional, but the SCOTUS has never ruled on it.
I hate to be the guy saying “cite your sources,” but I have quite a few sources that say “born secret” applies to everyone. Can you show me some evidence it doesn’t?
This source is about a related, but distinct, topic. It contains numerous example of the US government attempting to obligate non-cleared people to keep official secrets:
https://scholarship.law.upenn.edu/cgi/viewcontent.cgi?articl...
This source is a Wikipedia page, but it describes the government attempting to use “born secret” to censor a newspaper:
https://en.m.wikipedia.org/wiki/United_States_v._Progressive....
PS: From the first source:
In 1978, journalist James Bamford sent a Freedom of Information Act (FOIA) request to the Justice Department. He wanted documents related to the Department’s investigation of illegal wiretapping performed by the NSA. Among the surveillance programs the Justice Department investigated was Operation MINARET, which spied on Martin Luther King, Jr., Jane Fonda, and other opponents of the Vietnam War. The chief of the Justice Department’s special litigation unit, the unit that led the investigation into the NSA, took ten months to review the request. In the end, the Justice Department declassified and released 250 pages of documents to Bamford. When the NSA found out about the disclosure, however, it argued that the documents should never have been released and demanded that the Justice Department label them as classified. The Justice Department refused.
Two years later, with a new administration in the White House and new leaders atop the two agencies, the NSA tried again. This time, the Attorney General agreed. Bamford recalled a meeting with NSA and Justice Department officials. “They threatened to use the espionage statute against me,” Bamford recounted, “if I continued to refuse to return the documents.” A letter from the Justice Department soon followed: “You are currently in possession of classified information that requires protection against unauthorized disclosure,” it said, adding that Bamford should be aware of his “continuing obligation not to publish or communicate the information.”Keeping quiet was not enough for the Justice Department, however. “It is . . . your duty and obligation as a United States citizen to return this information to the Department of Justice,” the letter insisted.
Is that surprising? There's no physical law forcing legislators to write Constitutional laws or the executive branch to enforce them. They're just empty words until people actually implement them and then it's up to the Judiciary to review those implementations and resolve the ambiguities and inconsistencies between the laws and the real world. Unfortunately, there's nothing stopping bad laws from destroying lives on their way through courts, which often takes decades.
The Supreme Court hasn't decided the constitutionality of the born secret doctrine because the real world hasn't presented an opportunity. A core constitutional restriction of the courts is that they can't legislate, only rule on the cases that go before them. The doctrine has been abandoned by the government when push came to shove, likely because it knew the doctrine is indefensible before SCOTUS and only useful for the threat of litigation and criminal charges against civilians.
No, you don't. The government can ask you to do a great many things. They can use big, scary words that are designed to coerce you to do it. But that's not the same thing as being legally compelled to do it.
No charges were filed, there was no prosecution, and he's not in jail. Strongly worded letters are worth approximately the paper they're written on.
I would imagine information about informants or people with hidden identities would be considered privileged information in whatever state/local law enforcement jurisdiction created it, but penalties for leaking or distributing it would be a local matter, and many localities might not have specific laws on their books to deal with it.
Regarding on-going investigations, police aren't supposed to publicly discuss information about investigations, but they may if they deem that there is a public interest in doing so, or that doing so will help them with their case. I may very well be wrong here, but my gut suggests that in most places in the US there are likely not specific laws against public disclosure of details of ongoing investigations.
It's just the law in this case doesn't fit what happened.
That is only an argument, not a fact. They would have to persuade a court you are violation of the CFAA. That requires evidence. In almost all the previous cases with similar facts, the plaintiff provided notification and an instruction to cease and desist. Apparently, the plaintiff's lawyers or prosecutors thought they needed that as evidence. If you received such notfication, and you wished to avoid a CFAA claim, then you would follow the instruction and stop doing whatever Comcast is complaining about. And that would be the end of it.
The thing about the Swartz case is that he broke into a network closet and connected his laptop with ethernet cable directly to an MIT computer (networking equipment) in the closet. Even with this latest USSC decision, how could that ever be "authorised [physical] access".
>The idea that you could be authorized, but suddenly not
They were never authorized to use this system in this way, so there was not a "authorized but then suddenly not". The officer's authorization was static: not authorized.
Authorization is more than just the technical controls in a system, and lack of a technical control to prevent an officer using a system in certain ways does not mean said officer is authorized to use the system in any way they please.
The officer's actions were unauthorized on a system he was provided access to. He didn't gain unauthorized access to a system, he failed to follow the rules on a system he already had access to.
Er, no, that's specifically not the case. The officer's actions on the system in fact were authorized; he was authorized to look up licence plate information. The officer's actions later - specifically sharing private information with a third party - were criminal[0], and would be criminal regardless of whether a computer was even involved.
0: Give or take legislative and judicial corruption a al misrepresenting theft as 'civil forfeiture', but that's not really the point.
I don't think GP is in disagreement with you that it's potentially illegal, just that the CFAA shouldn't apply here.
I am confused about how(/whether?) confused you are about what I said.
> > > The officer's actions were unauthorized on a system he was provided access to.
The CFAA does not apply here, because the officer's actions on the system were authorized. He did not "failed to follow the rules on a system he already had access to", he followed those rules, then separately did something illegal[see previous footnote] with the information he obtained in accordance with those rules.
If his actions (on the system) were unauthorized, that would be a CFAA violation, even he was authorized to access the system in some other way.
- Logging onto the system: officer has technical access to log on and is authorized to log on, no problem
- Accessing normal data the officer needs for legitimate reason: officer has technical access to this data and is authorized to access it, no problem
- Accessing data for the purpose of a bribe: officer has technical access to this data, but is not authorized to access it, thus they are exceeding their authorized access
Put another way, he didn't work around any computer controls to get at the information.
That's irrelevant. You can do unauthorized things without having to "work around" controls.
>He clearly did not hack into the computer system to get the data, and that's what the CFAA was meant to prosecute.
The CFAA was meant to prevent computer-related crimes including but not limited to unauthorized access, fraud, abuse, etc, which this clearly was.
SCOTUS disagrees with you, and so do I.
> The CFAA was meant to prevent computer-related crimes including but not limited to unauthorized access, fraud, abuse, etc, which this clearly was.
He didn't do any of those with respect to the computer system. He accessed a resource that he had authorization to access as part of his job. He misused it, but didn't break into the system or gain access by fraud. His reasons for accessing the data were wrong, but his access was authorized.
If the officer was explicitly told 'you can use the computer system, and it can do plate lookups, but you're not allowed to perform plate lookups ever', then he went ahead and made a plate lookup anyway, I'm not entirely clear that the ruling would exclude that from being a CFAA charge, even without there being any password or permission model to lock him out of that functionality. I could be wrong there - there may be other caselaw on that - but I didn't read much in the ruling that suggested they were interested in the extent to which the system technically restricted access to this functionality.
But in this case he had legitimate technical access, he was authorized to use it to look up plate data, and the SCOTUS verdict, sensibly, concludes that using that access for an illegitimate purpose does not merit a CFAA charge.
This, by definition, makes his access unauthorized. That's the point. "Authorization" is more than just technical controls. He was not authorized to access the data for this reason.
You are applying too broad a definition to "authorization." In this context it refers specifically to the configured authorization behavior of the computer system. They gave him the equivalent of a key to a lock implemented in the computer system, and the law is meant to address the equivalent of someone who pick locks, not someone who misuses the access provided by keys they were given.
SCOTUS just literally said the opposite.
The term "unauthorized" is overloaded. There is one sense in which he was unauthorized by policy. There is another sense by which he was authorized by technical access. These are separate scenarios and separate violations. It makes no sense for unauthorized-by-policy to be a violation of a computer hacking statute.
At the "seems pretty clearly like unauthorized access" end of the spectrum, we can imagine someone brute-forcing a password to gain access to a system. They're "authorized by technical access" once they have the username/password, but that's surely a focal case of the kind of crime that the statute was intended to address.
Alternatively, say there was a guest account activated with a default password.
Would we argue that someone with no relationship to the owner who discovered the account was active and then used it was "authorized by technical access"?
Presumably the answer is that authorization in that case depends on whether it was the intent to allow strangers to use the system as a guest or whether it was some kind of technical oversight.
What about if you were hired as a data entry operator, but your account was accidentally set up as a superuser? The owner of the system intended to give you one level of access but accidentally gave you another. Are you a hacker if you use the unintended access grant to snoop around? Again, you're "authorized by technical access".
What about if your boss puts his username/password on a post-it note on his monitor and you use his account without his knowledge? What about if you use it with his knowledge and agreement?
> That's irrelevant. You can do unauthorized things without having to "work around" controls.
You are conflating bypassing security measures (which in the digital world would be equivalent of lock picking) and abuse of trust (throwing a party and trashing the home of someone who trusted you with the keys to only feed the cat).
Say I give a neighborhood kid a key to come water my plants while I'm out of town. If they use that key to gain access and throw a party they're trespassing. I don't see why it should be different for a CPU
For purposes of this law, it is. The Government agreed “that Van Buren ‘access[ed] a computer with authorization HK’ when he used his patrol-car computer and valid credentials to log into the law enforcement database” [1].
“The dispute is whether Van Buren was ‘entitled so to obtain’ the record.” The Court found that Van Buren was entitled so to obtain the record, in that entitlement is the operative word. If the file is electronically accessible to the user, they have entitlement to so, *i.e. electronically, obtain it. They aren’t properly authorised or permitted or something else to it. But those weren’t the words used. "Authorized," unadorned, and "entitled so to."
[1] https://www.supreme court.gov/opinions/20pdf/19-783_k53l.pdf
Did he steal your key? Or did you give it to him? If he stole your key, he wasn't entitled to your house. But if you gave him the key, he had entitlement to it.
If this were a friend, not a kid, you might be able to sue her for throwing a party in your house without permission. You would not be able to get her charged with breaking and entering because she overstepped the conditions that came with your key.
Presume they had intent to water and steal at a felony level when they entered.
If they had to break open the door, entering would be burglary.
Using a key they were supposed to have, to enter a building they were supposed to be able to enter? I would say it should be treated like the former case, not the latter case.
US law may not always agree with me, and apparently there are states where shoplifting can count as burglary. But I say stretching the definition that far is ridiculous.
Basically, I would say that unauthorized access should require some material deception to gain access. So if you socially engineer your way in, it's unauthorized--you lied to someone. If you use a computer virus, it's unauthorized--you lied to the computer to get it to execute that code, probably misrepresenting it as some other type of data. If they set the permissions wrong or it's just an AUP thing, it's not unauthorized access. Though, as here, it might be against the law for some other reason (violation of privacy or whatever).
This would avoid catching people out because someone set permissions to give too much access or wrote overbroad AUPs that shouldn't be turned into federal felonies, while providing a nice bright line because you can actually test whether, if not for the deception, they'd have been granted access to the system, especially the computer side of that. So the people who used anonymous FTP with a fake email won't become felons because it's easy to prove the system lets in everyone no matter what their email is set to, whereas the person using someone else's credentials lied to the system about who they are and should get punished, etc.
I think that my test would be consistent with this holding, but remember that this is merely my view of how the law should be. It's not a description of how the law is, it's something I would advocate that I believe provides a reasonable boundary between authorized an unauthorized access that's both clear and testable.
Interesting test. What if you set your user agent to chrome instead of firefox and that grants you access to a website?
Fwiw, from my readings of similar cases, this seems similar to how the courts read the law. Any access you can achieve without material deception is valid. There was a case on here a while back where a couple of reporters filed a FOIA request and the city accidentally put records not meant for release in the Dropbox folder. Reporters downloaded the accidentally-added files, city sued. The city ended up settling because it looked like the court was going to rule against them.
The court's logic was basically that by allowing access to the information, you have de facto authorized the user to access it. It would be impossible to tell whether you can legally access any information if the counterparty can give you access and then decide you shouldn't have seen it when you do access it.
The website is at fault. This is no different than lying about your religion to bypass a discriminatory shop owner.
A naive generalization might say that "lying" by setting a header = illegal. But clearly there is a difference between setting the Authorization header and setting the User-Agent header.
But what about headers that are not so well-defined? What about custom headers?
I'm not disagreeing with you, but these are the first questions that come to mind.
It seems that a judge would have to carefully consider the design of the system, and whether the vector that granted access was something that was clearly negligent on the part of the site owner, or was truly an attack vector and deemed illegal. But it seems difficult to formulate a universal test for this.
No. If you falsify information indicating that you have authorization to access the site, it doesn't matter what header it's in. Conversely, if you falsify information that has no bearing on whether you have authorization to access the site, it also doesn't matter what header it's in.
You are either authorized to access the site (or URL, or whatever) or you are not. What tools you use to do so are only relevant if they cause you to generate accesses (eg network requests) that you are not authorized to make. By construction, configuring one tool to generate accesses as they would have been generated by another tool does not produce unauthorized accesses unless that other tool's normal accesses would be themselves be unauthorized.
Ahh, but here's where things get tricky. Who decides that the information has no bearing on whether you have authorization to access the site?
Imagine a situation where a very poorly designed site allows "My-Obscure-User-Agent", but denies all other User Agents. This is obviously a horrible design, but if the intent of the developer was to authorize access to a specific set of internal clients, identified by a unique/non-standard user-agent, how would you classify the act of changing one's browser settings to send the accepted agent?
User Agent is a great example of something that has a pretty well-defined purpose (and that purpose has nothing to do with authorization), but has also been misused by naive or lazy developers to control access to sites.
> to authorize access to a specific set of internal clients,
Are you, the person, authorized to access the site? If yes, setting a User Agent header to "My-Obscure-User-Agent" is truthful (insofar as it bears on whether you (the person) are authorized), regardless of whether you are using the prescribed internal client. If you are not authorized, the use of said internal client doesn't change that.
Edit: as a analogy, suppose you took a job and your employer provided you with a uncomfortable uniform jacket which your employment contract stipulated you must wear when on the job. If you acquired a more comfortable jacket and dyed it to resemble the uniform, your employer would (arguably) be within their rights to refuse you access (blocking by user-agent), but if they let you in, that does not mean you have entered (the employee-only portions of) your workplace without authorization. Same applies to cars, phones, power tools, etc; you may have done something wrong by bringing them to work, but that something is not unauthorized entry.
> configuring one tool to generate accesses as they would have been generated by another tool does not produce unauthorized accesses unless that other tool's normal accesses would be themselves be unauthorized.
Therefore: When you generate a request that spoofs the obscure user agent string, it is authorized only if you were also authorized to use the obscure agent. The string is a secret like any other, even if it's a secret shared by the entire group of people who were provided with the obscure agent.
On the other hand, is it really a secret if the agent tells it to every server that the agent connects to? At some point it's not a secret if little care is taken to protect it (and the name of the header has some bearing on what care is taken, for example whether it ends up stored in clear text in access logs...).
"it is authorized if and only if you were also authorized", but otherwise yes, exactly.
| A | B |A-only-if-B|A-if-and-only-if-B|
|false|false| true | true |
|false|true | TRUE | FALSE |
|true |false| false | false |
|true |true | true | true |
However, if the columns of your matrix were modified to compare "if" versus "[if and] only if" (where square brackets represent an optional component that does absolutely nothing), I'd agree with the logic, being analogous to the difference between OR and XOR (for the boolean sense of OR, not the English sense which is akin to XOR).
And now I'm not sure I'm not the one who isn't reading things properly. (And that sentence probably doesn't help matters.)
I'll point to (the "only if" part of) https://en.wikipedia.org/wiki/If_and_only_if#Distinction_fro..., which I think agrees with me and disagrees with you, assuming I'm not misreading one or both.
I think Congress' intent with CCFA was to criminalize hacking. There are already laws against fraud, so we don't need a deceitfulness test to catch, say, social engineering. The problem I think is that CCFA was written in 1986 and not enough people understood what hacking was well enough to write it down clearly in the law, so instead the "excess of authorized access" language is in the law, and has been used to criminalize lots of things that aren't really hacking and Congress didn't intend to criminalize with the CCFA.
I haven’t read the decision closely enough yet to see how well developed that idea is.
edit: I certainly don't agree that the distinction between access to a file in a file cabinet and a record on a computer should be significant. I think it's a dumb law. But the unauthorized access test is straightforward. If I work at a company that disallows internet browsing other than for work purposes and I visit my facebook page, I think that's a clear case of hacking under the "authorized access" test, and my only real defense would be that I needed to check facebook for work.
Yes. And SCOTUS's problem is that they think the punishment for visiting facebook at work shouldn't be the same as the punishment for stealing company records - and that's fine, and of course something I agree with. But SCOTUS should actually address that directly, rather than going down this weird path of trying to warp the definition of "authorized".
I don't think they are. I think SCOTUS is looking at this, as is their wont, from a legal perspective.
We have two legal systems: civil and criminal. Both of them have the concept of "authorized." What SCOTUS has said here is that whether or not something is unauthorized may be a civil tort claim--you broke a contract--versus a criminal offense--you broke the law.
That seems to be the knot everyone is trying to untie here. It's not illegal for me to break a contract with someone. It is illegal for me to break the law.
Now, if your employer put software on your machine or on their network that prevents you from viewing Facebook, and you work around that restriction, it could be argued that you have now "hacked" their network and gained access you were not authorized to have.
The distinction is pretty clear in the ruling - if you have access, you can do X without it being considered a violation of the CFAA (doesn't mean you can't be fired, or prosecuted for other crimes leading from the actions, or other repercussions). If you don't have access, and you figure out a way to gain access, it is now a violation of the CFAA.
Don't get me wrong, I understand how that can be straightforwardly interpreted as "unauthorized access." I'm advocating for what the law should be, in my view. The idea is to make a bright line that gives a test for mens rea to avoid over-criminalization while not being too unreasonable. I'm sure there could be scenarios I haven't thought of that would turn out poorly.
This seems like a poor definition, IMO.
For example, what if I tell you I'm going to club you over the head and get access to the computer you're on. And I do so. There was no material deception. I did exactly what I said.
Another example is what if I just walk around the counter while you're not there. There is no one around to deceive.
Then there’s no hacking and you should be charged with assault or whatever else is appropriate.
> Another example is what if I just walk around the counter while you’re not there.
Then it doesn’t matter if there was an unlocked computer or an unlocked cabinet behind that counter.
There doesn’t need to be, for every illegal act X, an extra special law or punishment for “X but a computer was involved”.
People want a criminal penalty for hacking and maybe they’re right, but you shouldn’t try to cover every undesirable act that involves a computer with a single law any more than every undesirable act that involves a piece of paper is covered with one. You also shouldn’t claim that breaking down a door is the same as walking through an open one, even when both constitute (among other things) trespassing.
I mean, sure the usual "plain ol' bullying laws" might need an update to keep up with the times but a whole separate set of laws just to capture "but it used a computer" is silly.
Mind you, I also have a thing about professional sports breaking out into punchfests. They should get prosecuted for assault or whatever just the same as anyone on the street.
That's either a true threat, or assault and battery. It only becomes computer fraud if you fraudulently use my credentials to access the computer.
> Another example is what if I just walk around the counter while you're not there. There is no one around to deceive.
That's trespass, not computer fraud.
There's more than one crime on the books. Saying that something isn't computer fraud isn't claiming that all those things should be legal.
Like in this case, I think it should be bribery more than computer fraud.
Why is that trespassing? There's no sign that says I can't go behind the counter? In fact, in many cases you can go behind the counter, just you aren't expected to jump on their computer. The problem isn't that I'm behind the counter. The problem is that I'm using a computer I'm not authorized to use -- it's just whoever set up the computer didn't set up an authorization gateway.
But really access to the computer really isn't fraud. It's what you do once your at the computer that matters much more. Its authorization for the action that matter, not access authorization.
Let’s take computers out of the picture again. Suppose I know that an organization O throws out folders with sensitive data D into the trash can in their publicly-accessible lobby every Friday at 3 pm. People that want to know D pay me to come there at 2:55, root through the can and write down the pieces that they need.
Should what I am doing be illegal? Whatever your answer, is it in any way different from walking around that same lobby sniffing O’s open Wi-Fi network except for “computers were involved”?
Can I walk into a bank and take all the money from the vault if they leave it open? But yet somehow with a computer that isn't yours you seem to be stating that if you don't properly protect it then access to it by anyone who happens upon it is completely legal.
You wrote it as if it's somewhere you're not authorized to be, e.g. an Employee's Only section which would tend to be trespass. If you are authorized to be there and they leave records out that they shouldn't, I think that failure is on them and they need to improve security.
If someone leaves a database of everyone's personal details on an open webserver, that doesn't become hacking or computer fraud if someone visits the site. I mean, I don't think it should be true that I could say "you, specifically, aren't authorized to read this post" and have that morph into a federal felony.
In my view, there has to be at least some kind of notice that someone is crossing a criminal boundary. I think lying makes a decent, if imperfect, boundary. It's possible that someone can think of something better, too.
This is very, very good news.
https://www.eff.org/deeplinks/2020/01/eff-asks-supreme-court...
https://www.eff.org/deeplinks/2021/06/supreme-court-overturn...
If this were not a ruling in favor of a police officer, I feel that you would see a much more positive response. The past few years of political craziness have warped peoples' minds where they can't recognize a good thing anymore.
And the way to make that happen is by limiting the scope of the law as much as possible, in order to force law makers to rewrite it. Which is what has happened here. If law makers did intend the rejected interpretation, then they should rewrite it to clarify such.
I doubt that will actually happen, though. Our system basically assumes that laws will be written to be vague and ambiguous, and that courts will clarify the interpretation over time. I don't think this is a very good way to run things, but it seems to be the way we've settled on.
Instead of law makers fixing the problem, the supreme court is effectively reading between the lines. Luckily IMHO they are doing the right thing here and will put this particular employer based scenario to rest.
Now to clarify on the countless other holes in the CFAA...
I have mixed feelings on the ruling. It sounds to me like a crime did occur. But the CFAA is also overly vague... Without reading the details of the case and the statue, it's hard for me to be sure what to think here.
I guess looking forward, this will force police departments and others to be more explicit in their access policies, which it sounds like here there just wasn't any?
I guess that's a win?
It sounds pretty harsh but to me it's boils down to this: while textualism can lead to excesses & dubious interpretations by judges...The alternative can lead to any interpretation since it surrenders the entire judicial process to the judges while hoping they won't go too far because they just wouldn't dare?
I am sympathetic to the criticisms of the "living document" ideology. It's populism masquerading as jurisprudence. Or, as Scalia put it, it's no philosophy at all.
HOWEVER, textualism is not as clean as it's advocates will argue. Case in point: The post-Civil War era Supreme Court (the so-called "Redeemer" court) went out of it's way to essentially dismantle legislation aimed to protecting minorities in the name of textualism.
This was the origin of hate crime legislation, which came about because of jury nullification, essentially.
Consider the aftermath of the Colifax massacre [1]:
> This decision, in United States v. Cruikshank, the legal historian Lawrence Goldstone argues, provided a guide for the campaign of racist terrorism that would suppress the black vote and enshrine a white man’s government for generations. “The Colfax defendants would have had to announce their plan to violate their victims’ rights on account of the color of their skin in order to be culpable,” Goldstone wrote. “Justice Bradley had thus communicated to any Redeemer with violent intent that to avoid federal prosecution one need simply to keep one’s mouth shut before committing murder.”
[1]: https://www.theatlantic.com/ideas/archive/2018/09/redemption...
> The Government’s interpretation of the “exceeds authorized access” clause would attach criminal penalties to a breathtaking amount of commonplace computer activity. For instance, employers commonly state that computers and electronic devices can be used only for business purposes. On the Government’s reading, an employee who sends a personal e-mail or reads the news using a work computer has violated the CFAA. The Government speculates that other provisions might limit its prosecutorial power, but its charging practice and policy indicate otherwise.
- two state charges of breaking and entering with intent to commit a felony
- wire fraud, computer fraud, unlawfully obtaining information from a protected computer, and recklessly damaging a protected computer
- breaking and entering with intent, grand larceny, and unauthorized access to a computer network
- federal prosecutors filed a superseding indictment adding nine more felony counts, which increased Swartz's maximum criminal exposure to 50 years of imprisonment and $1 million in fines
My initial reaction to the headline I read was anger that an officer got away with abusing his power. But upon learning the details, it's clear that a CFAA violation is an inappropriate charge here.
While I agree with your assessment, it was not just "unauthorized", it was straight up corruption. Making an agreement to accept a $5000 cash payment from some sketchy dude to look up a third party's accessible-to-law-enforcement only details. The guy should have been prosecuted under various existing corruption statutes and not the CFAA.
When I saw it was a 6-3 decision my first instinct was "oh another conservative-liberal divide" but no it isn't. I'm actually surprised to find Thomas dissenting since he's just. a stickler for the literal text.
To me the ruling seems correct: the offender may have exceeded department rules and such access by that measure was "unauthorized" but he was not an unauthorized user to the system.
It's refreshing to see limits to the overreach on what constitutes "hacking". This isn't hacking.
Were this ruling in effect when Aaron Swartz was charged, I very much suspect it would've invalidated the hacking charges under the CFAA (since he used a guest account he had access to).