Hacker News Reader

Comment by kstrauser | Hacker News Reader

> That's irrelevant. You can do unauthorized things without having to "work around" controls.

SCOTUS disagrees with you, and so do I.

> The CFAA was meant to prevent computer-related crimes including but not limited to unauthorized access, fraud, abuse, etc, which this clearly was.

He didn't do any of those with respect to the computer system. He accessed a resource that he had authorization to access as part of his job. He misused it, but didn't break into the system or gain access by fraud. His reasons for accessing the data were wrong, but his access was authorized.

View on HN

Actually I don't know that SCOTUS has much to say in this ruling on the necessity of effective technical controls.

If the officer was explicitly told 'you can use the computer system, and it can do plate lookups, but you're not allowed to perform plate lookups ever', then he went ahead and made a plate lookup anyway, I'm not entirely clear that the ruling would exclude that from being a CFAA charge, even without there being any password or permission model to lock him out of that functionality. I could be wrong there - there may be other caselaw on that - but I didn't read much in the ruling that suggested they were interested in the extent to which the system technically restricted access to this functionality.

But in this case he had legitimate technical access, he was authorized to use it to look up plate data, and the SCOTUS verdict, sensibly, concludes that using that access for an illegitimate purpose does not merit a CFAA charge.

>His reasons for accessing the data were wrong

This, by definition, makes his access unauthorized. That's the point. "Authorization" is more than just technical controls. He was not authorized to access the data for this reason.

> "Authorization" is more than just technical controls.

SCOTUS just literally said the opposite.

> "Authorization" is more than just technical controls.

You are applying too broad a definition to "authorization." In this context it refers specifically to the configured authorization behavior of the computer system. They gave him the equivalent of a key to a lock implemented in the computer system, and the law is meant to address the equivalent of someone who pick locks, not someone who misuses the access provided by keys they were given.

Reply on news.ycombinator.com