Thursday, June 3, 2021

In 6-3 opinion for (police officer) defendant, SCOTUS limits reach of federal Computer Fraud and Abuse Act

The Supreme Court issued one opinion this morning, and it is an interesting criminal law decision with an interesting divide of Justices limiting the reach of a notable federal criminal statute.  The majority opinion in Van Buren v. US, No. 19–783 (S. Ct. June 3, 2021) (available here), is authored by Justice Barrett and it starts and ends this way:  

Nathan Van Buren, a former police sergeant, ran a license-plate search in a law enforcement computer database in exchange for money.  Van Buren’s conduct plainly flouted his department’s policy, which authorized him to obtain database information only for law enforcement purposes.  We must decide whether Van Buren also violated the Computer Fraud and Abuse Act of 1986 (CFAA), which makes it illegal “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.”

He did not.  This provision covers those who obtain information from particular areas in the computer — such as files, folders, or databases — to which their computer access does not extend.  It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them....

In sum, an individual “exceeds authorized access” when he accesses a computer with authorization but then obtains information located in particular areas of the computer —  such as files, folders, or databases — that are off limits to him.  The parties agree that Van Buren accessed the law enforcement database system with authorization. The only question is whether Van Buren could use the system to retrieve license-plate information. Both sides agree that he could.  Van Buren accordingly did not “excee[d] authorized access” to the database, as the CFAA defines that phrase, even though he obtained information from the database for an improper purpose.  We therefore reverse the contrary judgment of the Eleventh Circuit and remand the case for further proceedings consistent with this opinion.

Justice Thomas authored a dissent joined by the Chief Justice and Justice Alito. It starts this way:

Both the common law and statutory law have long punished those who exceed the scope of consent when using property that belongs to others.  A valet, for example, may take possession of a person’s car to park it, but he cannot take it for a joyride.  The Computer Fraud and Abuse Act extends that principle to computers and information.  The Act prohibits exceeding the scope of consent when using a computer that belongs to another person.  Specifically, it punishes anyone who “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains” information from that computer. 18 U.S.C. §1030(a)(2).

As a police officer, Nathan Van Buren had permission to retrieve license-plate information from a government database, but only for law enforcement purposes.  Van Buren disregarded this limitation when, in exchange for several thousand dollars, he used the database in an attempt to unmask a potential undercover officer.

The question here is straightforward: Would an ordinary reader of the English language understand Van Buren to have “exceed[ed] authorized access” to the database when he used it under circumstances that were expressly forbidden? In my view, the answer is yes.  The necessary precondition that permitted him to obtain that data was absent.

The Court does not dispute that the phrase “exceeds authorized access” readily encompasses Van Buren’s conduct. It notes, instead, that the statute includes a definition for that phrase and that “we must follow that definition, even if it varies from a term’s ordinary meaning.”  Tanzin v. Tanvir, 592 U.S. ___, ___ (2020) (slip op., at 3) (internal quotation marks omitted). The problem for the majority view, however, is that the text, ordinary principles of property law, and statutory history establish that the definitional provision is quite consistent with the term it defines.

I am pretty sure that this is the first (non-unanimous) opinion in which all the Trump-appointed Justices joined with all the Justices appointed by Democratic presidents, and I am very sure that I am hopeful that this will not be the only case in which these Justices combine to limit the application of questionable criminal laws and doctrines. Interesting times.

Via Law http://www.rssmix.com/

No comments:

Post a Comment