Van Buren is a victory against overbroad interpretations of the CFAA

That is not the meaning of the ruling. Nothing precludes trying someone for other crimes.

People are calling this a win because the CFAA, as it used to be interpreted, would have had you potentially charged for changing the url of this post from 'https://news.ycombinator.com/item?id=27389500' to this 'https://news.ycombinator.com/item?id=waffles'. This allowed cops/feds to charge you with crazy high penalties if they really wanted to make you sweat, see Aaron Schwartz

Some of the most memorable SCOTUS cases had less than noble test cases (ever hear of Miranda rights? https://en.wikipedia.org/wiki/Miranda_v._Arizona). SCOTUS isn't deciding if the defendant is a dirt bag or not, just if the very specific law is valid/applied correctly

That said, I have sympathy for the dissent as well which essentially argues that the majority is drawing an awful fine distinction here. i.e. so long as you're OK to access a system for some purpose, you're fine so far as the CFAA is concerned.

They would not be criminally liable under CFAA, but they can absolutely be charged with other crimes in such a circumstance

Now Van Buren is given a key to access the filing room for his duties, and then uses his key to go in and look up the file on some license plate in exchange for money.

Clearly, this is a terrible breach of trust and authority. It should be against policy. He should be fired. Likely there should also be criminal statutes about police or government employees selling or abusing government records.

But he's not guilty of breaking and entering. He was given access to that data, even if this is not what he was supposed to be going in there for.

As one of the justices noted, if merely misusing computer access that you were otherwise allowed to access were a criminal offense, then potentially "an employee sending a personal email or checking sports scores on a work device" could be criminal, rather than just breaking a company policy.

I wouldn't disagree with your judgement here, but you wouldn't charge him with murder right? Neither should you charge him with hacking.

> If I start selling off information about user to third parties (say journalists), how can that be legal?

Well, by default it would be legal, except I imagine any employment contract would have a provision around privacy, disclosure, and trade secrets, etc. You'd be in violation of the contract, and since you made money from it, some form of fraud or similar would apply.

The question is, would you consider that the same crime as someone without access to the production database breaking in and grabbing the data, and perhaps just giving it away for free (so they'd avoid committing a bunch of other criminal acts).

I don't think even this is something that follows naturally.

For example, a human can sit next to the highway and write down license plates. However, it is still a crime if you use a computer to do the same (and perhaps sell a huge database containing this information).

The Supreme Court decision does not by itself exonerate Van Buren. It just remands the case to the lower court to decide again, taking into account the clarification of the CFAA's applicability. Van Buren could still be found guilty and punished, on other grounds.

Just because some action involves a computer (database) and does not violate the CFAA does not necessarily mean it will not trigger potential culpability or liability under other criminal or civil law.

If an employer only allowed employees to use their work computers for work (I assume most do, at least officially) as soon as an employee does anything personal on it (checks FB, checks HN, etc) even if on lunch break, they have exceeded their authorization, broken the law under the CFAA, and face up to 10 years in prison.

It is typical for a prosecution to include every charge possible. In this case they included the CFAA, and the Supreme Court said that particular charge was an invalid application of that particular law. It has no effect on any other charges, and no effect on any other laws.

It is refreshing because it doesn't put the risk of federal criminal prosecution at the whim of how an employer writes their policies.

The accused in the case was caught in a sting operation. The police created a fake situation where they pretended to have an undercover agent, and tries to see if the accused would interfere with the case. He did. The prosecutor however did not charge the accused over obstruction of justice, but rather CFAA and hacking charges. I would guess that the reason is that the prosecutor thought it was easier than charging someone with interfering with a fake case.

From what I understand, courts and judges do not like it when either side try to be clever. CFAA is not a tool to be used when the prosecutor want to avoid a more difficult case, and so it needed to be limited in scope.

The prosecutors decided to charge him under the CFAA because the data he sold for money was stored in a computer system. Van Buren accessed data he was authorized to access, using his own perfectly valid credentials. Because of this, the Supreme Court says it is not a violation of the Computer Fraud and Abuse act. They say that a person cannot be charged under the CFAA just because the crime they committed involved a computer.

Reducing the scope of the CFAA in case law just means that we take the teeth out of a overused and honestly crappy law that's ruined lives without reason to.

The issue is that this is a hacking statue. He didn't hack into the system, he just used it in a bad way. The punishment should be the same if he got it from a filing cabinet he had the keys to.

The takeaway isn't "If you have access, everything you do is legal" -- not for computers, not for filing cabinets.

Whether Van Buren deserves punishment is a separate question from whether the legal theory the DoJ sought to use to get him punished was proper.

> Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it.

No, it doesn't. This is not a finding that the activity is Constitutionally protected, or even non-criminal in any broad sense, but that it is not within the scope of the criminal provisions of the CFAA, which is a win, because the interpretation of the CFAA necessary to make it applicable is ludicrously broad.

> In other words, lets say I work at a gay hookup website and they grant me access to their production database as part of my job. If I start selling off information about user to third parties (say journalists), how can that be legal

It shouldn't be, but that doesn’t justify abusing the CFAA into a blank prosecutorial check.

There are many other laws that you can still be charged with that govern what you access, irrespective of how, ie copyright, child porn, confidential information.

The people who view this as a win are worried that if "authorization" is defined as "against any rule, made by anyone" then the CFAA could be used to criminalize almost anything online. Note that restriction of the CFAA does not let you off the hook of other laws.

The people who worry about this are worried that judges had to use a fair bit of extrapolation and guessing as to the intent and effects of the law because the wording is pretty vague, and probably problematic for internet activity if interpreted very narrowly.

The decision does not prevent punishment. It narrows the scope of how the CFAA can be applied. Had it been interpreted as broadly as the government asked, terms of service violations would be open to Federal prosecution. The EFF article lays out some particularly troublesome implications, like criminalizing the use of your work computer for personal matters.

> If I start selling off information about user to third parties (say journalists), how can that be legal?

It's not. The decision simply states that because you were given access, you can't be charged specifically for hacking. You would still on the hook for stealing and selling the data.

Just because a computer was used doesn't mean it was "hacking".

The Supreme Court essentially limited the scope of the CFAA to unauthorized access of a computer system. That is a good thing. The alternative is your employer could institute a policy change in what you can use internal systems for and you could find yourself on the wrong end of a CFAA "hacking" criminal prosecution. That's not hyperbole.

On a side note, we once again find Thomas on the wrong side of history. The dissenters have gone well beyond what they might argue is strict textualism to simply supporting broad authoritarianism.

Aaron Swartz is frequently brought up here as a prime example of prosecutorial overreach. For example, he was charged with "hacking" with the (then) interpretation of the CFAA, which then compounded to other charges, like breaking and entering to commit a felony (CFAA "hacking" was that felony).

We need less not more overbroad legislation.

After reading the background info in the Supreme Court decision PFD... Agreeing to accept a $5000 cash bribe from some sketchy dude for information available only to law enforcement, undoubtedly falls within many existing anti-corruption laws that he could have been prosecuted under.

In your gay-hookup-website example, you might be civilly or criminally liable in various states of the US under a variety of laws that have nothing to do with computers. For example:

· an invasion-of-privacy tort or negligent-infliction-of-emotional-distress tort due to publicly disclosing private facts about the plaintiffs;

· a breach-of-contract tort or tortious-interference tort or negligence due to damaging your employer's business relations with the users (especially if you signed an NDA);

· a misappropriation-of-trade-secrets tort arguing that the users' information is a "trade secret" of the employer;

· a breach-of-fiduciary-duty tort claiming that if someone was going to get paid for the users' information it should have been your employer and not you;

· a breach-of-confidence tort claiming that your employer owed the users a duty of confidentiality, and you correspondingly owed it to your employer, and that you breached it by selling the data to journalists; or

· a conversion tort because you used the computer system in a way you were not authorized to use it.

(Also, the employer can probably recover whatever you were paid with an unjust-enrichment tort.)

Aside from being a tort, trade-secret theft is also a federal crime, so if your employer can persuade a prosecutor to go after you, they may be able to get you jail time. IANAL but I think the trade-secret case here is kind of weak, because in your scenario I think the journalist isn't running a competing gay-hookup website, so they aren't competing with your employer. There's also a crime of "criminal conversion", which I think is also kind of a stretch, since the employer can still use the computer system.

However, there was a civil conversion award for conversion of computer programs in Alabama in 01978, and another for conversion of personal information in New York in 02007: https://www.law.cornell.edu/nyctap/I07_0029.htm and in Oregon in 02013: https://www.tradesecretslaw.com/wp-content/uploads/sites/232.... Such innovations are still controversial and not widely accepted: https://www.nortonrosefulbright.com/-/media/files/nrf/nrfweb...)

What you are missing is that you are assuming that the CFAA is the only means by which Van Buren should be punished. So you are assuming that either the CFAA covers this abuse, or he gets off completely free.

The CFAA isn't the only means to deal with his conduct. Although it doesn't apply, he is still liable to be punished under whatever regime he was given access to it.

In simplified form:

He was granted access to the system pursuant to his employment - ie he was able to log into it, whereas the average citizen can't. Whatever conditions are applicable to that grant are the ones to apply when he abuses that access (eg if the policy says "you can only access this for these purposes, or you will be fired" then if he accesses it for a different purpose, they can fire him).

That is quite separate from the CFAA.

The CFAA is a parallel source of obligations, and is part of the criminal law.

Just because Van Buren breached the terms on which his employer let him access the database doesn't necessarily mean he committed a crime as well.

What SCOTUS did was say that the criminal law provision essentially deals with the "technical" side of access:

* if you get into a computer that you have no access to (ie hacking into it), you breach the relevant section.

* if you are authorised by the operator to have the technical means to access to certain info in the computer (eg permissions), and you do something to access other material, you breach the section (eg escalation of privileges)

* if you have the technical means to access the computer (eg log/password) and you access material that is permitted under those means (ie the user account), but you are not authorised to have that means of access (ie stolen login credentials), you also breach the section.

The problem with the interoperation that SCOTUS rejected was that under EULAs, the provider could essentially say "you can use our systems to log in and view information. But if we decide we don't like you, or you haven't paid your bill, or if you decide you are going to vote for politician X in the upcoming election, then if you actually view any information while you are logged in, you breach the act and commit a crime"

The rejected interpretation said: "authorised does not just mean you have been provided with the technical means to access the information, but also any additional conditions put on your use of the technical means by the person who granted it, which may change at any time" (eg change of policy, what is going through the user's mind)

So the answer to your observation:

> I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment.

is: it is exactly that. But it is punishment to be delivered via the process granting him the access to the information (ie whatever sanctions apply to violation of departmental policy). What he did was a breach of that policy, leaving him open to whatever sanctions are provided in it. But it is not also a crime under the CFAA.

> Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it.

Yes, you are confusing a policy violation for something more grand. I suspect most people are confused on this matter due to a selection bias favoring criminality for a violation of public trust.

But I am confused by the implications here.

How is port scanning different legally from brute forcing passwords? Iterating integers is fine, iterating the dictionary is not? What if there's an integer ID in the URL but it's MD5 hash'd and I recognize for what it is and iterate integers and MD5 them?

https://news.ycombinator.com/item?id=27382752