>His reasons for accessing the data were wrong
This, by definition, makes his access unauthorized. That's the point. "Authorization" is more than just technical controls. He was not authorized to access the data for this reason.
-5 karma · joined June 3, 2021
This, by definition, makes his access unauthorized. That's the point. "Authorization" is more than just technical controls. He was not authorized to access the data for this reason.
Yes. And SCOTUS's problem is that they think the punishment for visiting facebook at work shouldn't be the same as the punishment for stealing company records - and that's fine, and of course something I agree with. But SCOTUS should actually address that directly, rather than going down this weird path of trying to warp the definition of "authorized".
That's irrelevant. You can do unauthorized things without having to "work around" controls.
>He clearly did not hack into the computer system to get the data, and that's what the CFAA was meant to prosecute.
The CFAA was meant to prevent computer-related crimes including but not limited to unauthorized access, fraud, abuse, etc, which this clearly was.
- Logging onto the system: officer has technical access to log on and is authorized to log on, no problem
- Accessing normal data the officer needs for legitimate reason: officer has technical access to this data and is authorized to access it, no problem
- Accessing data for the purpose of a bribe: officer has technical access to this data, but is not authorized to access it, thus they are exceeding their authorized access
>The idea that you could be authorized, but suddenly not
They were never authorized to use this system in this way, so there was not a "authorized but then suddenly not". The officer's authorization was static: not authorized.
Authorization is more than just the technical controls in a system, and lack of a technical control to prevent an officer using a system in certain ways does not mean said officer is authorized to use the system in any way they please.
This line is the crux, and the problem is that "authorized" means subtle, yet critically important, different things to different people.
The officer was surely "authorized" in the sense that he had technical authorization to log into the system and accomplish the task.
But in the sense that "authorization" is defined by more than just technical controls, and also has to do with many dynamic situations that technical controls can't often restrict (or just aren't in place), it doesn't sound like was "authorized".
Think of walking into a restaurant and they have a sign that says "Employees Only Behind Counter". Even if there was no technical/physical control preventing you from going behind the counter (eg there was no locked door or anything like that), I think it would still be understood that you as a customer do not have "authorization" to go back there.
In my experience as a security consultant, my technically-minded clients typically think of "authorization" as the first way, defined by technical controls and thinking that lack of technical controls in a system means they have carte blanche to do whatever they want with that system. But my experience with anyone outside of tech is that they don't think of it that way at all, and that just because you have the physical/technical ability to do something does not make it okay to do that.
"Authorization" is an overloaded term and the CFAA suffer for it, but personally I do not think an average person would think the officer was "authorized" to do what he did, even if he did have the technical access to do it.
The points about "average employees technically violating the CFAA by doing stuff like reading the news on their work laptop" are valid concerns and I think they need to be resolved, but I think that is a completely different concern than someone like this officer abusing their access for legitimately bad acts.