Re:Van Buren is a victory against overbroad interpretations ...
by dmix on Friday June 04, 2021 @08:10PM
(#27400631)
So the actual crimes are far better enforced by more accurate legislation. Not swept up by an overly broad, and borderlom irrational interpretation of the CFAA.
For ex: the accused is still authorized to access the computer. A cashier at a grocery store is authorized to open/close the til all day long.
These may present opportunities but shouldn't be the focus of any crime. The theft itself is already firmly in the criminal code as being illegal.
The fact it was computers doesn't change things.
Certain employees at a hospital have authorization to pull up medical records as part of their jobs. It is extremely illegal for them to view records that aren't required for specific work purposes. If a nurse is treating Jane Smith in room 203, it's OK and normal for her to look at Jane Smith's records. It's absolutely not OK, and punishable with huge fines, for her to pull up her ex-boyfriend's records just out of curiosity.
However, it's not a violation of the CFAA for her to look at her ex's data. It's 100% against HIPAA, but she didn't have to break into a computer system to view them. She was authorized to access the system. She wasn't authorized (by virtue of her work requirements) to pull up those specific, but as a nurse, the system permitted her to without going around any login prompts or doing anything harder than typing "John Doe" into the search box.
That's the distinction that the CFAA cares about. It's about breaking into systems, or, at least, that's why it was written and that's how the SCOTUS just ruled that it was meant for. It's about access to the system in general, not access to a specific record in the system. There are other laws that govern those specifics.