<story><title>US Supreme Court Restricts Scope of Computer Fraud and Abuse Act [pdf]</title><url>https://www.supremecourt.gov/opinions/20pdf/19-783_k53l.pdf</url></story><parent_chain><item><author>ncallaway</author><text>I don&amp;#x27;t agree.&lt;p&gt;I think the other judges have the better reading of the specific language of the text. Thomas, Alito, and Roberts don&amp;#x27;t even take their dissent on the interpretation offered by the Government, but have to craft their own—extremely broad—interpretation of &amp;quot;entitled&amp;quot;.&lt;p&gt;Since I think the opinion (at least, the little bit of it that I&amp;#x27;ve skimmed) makes a fairly compelling case around the majority&amp;#x27;s interpretation of the words &amp;quot;so&amp;quot; and &amp;quot;entitled&amp;quot; I won&amp;#x27;t rehash that here. But, if we back up to the purpose and intent of the legislation, I think this outcome also better aligns with that.&lt;p&gt;The CFAA was designed to curtain the unauthorized use of computers. To make it illegal for people to deliberately circumventing the security measures built into computers to obtain information or cause other harm. If I hand you a computer, tell you the password, and ask you to login to my computer and respond to an email for me, but then ask you not to look in the `Taxes` folder on the desktop &lt;i&gt;should&lt;/i&gt; it be a felony for you to open the `Taxes` folder? That conceptually feels wrong to me. I have violated your trust, sure, but I haven&amp;#x27;t committed fraud, and I haven&amp;#x27;t abused any access control mechanisms on the computer.&lt;p&gt;Or another scenario: your work gives you a work computer, and has a paragraph in the employee handbook that says you are never allowed to visit news.ycombinator.com on the work computer. At some point while working at the company, you visit news.ycombinator.com on the work computer. Have you just committed a felony? You&amp;#x27;ve &amp;quot;exceeded the authorized access&amp;quot;, if you interpret &amp;quot;entitled&amp;quot; and &amp;quot;authorized&amp;quot; as broadly as Thomas, Alito, and Roberts seem to. Should that really be a felony?&lt;p&gt;That interpretation leads to such a massive broadening of felony criminal liability. It doesn&amp;#x27;t gut-check for me. That, combined with what I perceive as the better textual reading of the phrases &amp;quot;so&amp;quot; and &amp;quot;entitled&amp;quot;, I have to disagree with you. I think the other 6 justices had the better argument at multiple levels.</text></item><item><author>blakesterz</author><text>I guess this is the part that matters most?&lt;p&gt;&amp;quot;We must decide whether Van Buren also violated
the Computer Fraud and Abuse Act of 1986 (CFAA), which
makes it illegal “to access a computer with authorization
and to use such access to obtain or alter information in the
computer that the accesser is not entitled so to obtain or
alter.”
He did not. This provision covers those who obtain information from particular areas in the computer—such as
files, folders, or databases—to which their computer access
does not extend. It does not cover those who, like Van Buren, have improper motives for obtaining information that
is otherwise available to them&amp;quot;&lt;p&gt;Thomas, Alito and Roberts dissented, and I hate to say it, but I agree with them.&lt;p&gt;&amp;quot;The question here is straightforward: Would an ordinary
reader of the English language understand Van Buren to
have “exceed[ed] authorized access” to the database when
he used it under circumstances that were expressly forbidden? In my view, the answer is yes. The necessary precondition that permitted him to obtain that data was absent.&amp;quot;&lt;p&gt;That&amp;#x27;s Thomas dissenting.</text></item></parent_chain><comment><author>WillPostForFood</author><text>&lt;i&gt;That interpretation leads to such a massive broadening of felony criminal liability. It doesn&amp;#x27;t gut-check for me&lt;/i&gt;&lt;p&gt;I agree with you, it totally fails the gut check, but it is because the law is poorly written. The Supreme Court bailed out the lawmakers by winging it here. The minority opinion is the worse, but more accurate plain reading of the law.</text></comment>
<story><title>US Supreme Court Restricts Scope of Computer Fraud and Abuse Act [pdf]</title><url>https://www.supremecourt.gov/opinions/20pdf/19-783_k53l.pdf</url></story><parent_chain><item><author>ncallaway</author><text>I don&amp;#x27;t agree.&lt;p&gt;I think the other judges have the better reading of the specific language of the text. Thomas, Alito, and Roberts don&amp;#x27;t even take their dissent on the interpretation offered by the Government, but have to craft their own—extremely broad—interpretation of &amp;quot;entitled&amp;quot;.&lt;p&gt;Since I think the opinion (at least, the little bit of it that I&amp;#x27;ve skimmed) makes a fairly compelling case around the majority&amp;#x27;s interpretation of the words &amp;quot;so&amp;quot; and &amp;quot;entitled&amp;quot; I won&amp;#x27;t rehash that here. But, if we back up to the purpose and intent of the legislation, I think this outcome also better aligns with that.&lt;p&gt;The CFAA was designed to curtain the unauthorized use of computers. To make it illegal for people to deliberately circumventing the security measures built into computers to obtain information or cause other harm. If I hand you a computer, tell you the password, and ask you to login to my computer and respond to an email for me, but then ask you not to look in the `Taxes` folder on the desktop &lt;i&gt;should&lt;/i&gt; it be a felony for you to open the `Taxes` folder? That conceptually feels wrong to me. I have violated your trust, sure, but I haven&amp;#x27;t committed fraud, and I haven&amp;#x27;t abused any access control mechanisms on the computer.&lt;p&gt;Or another scenario: your work gives you a work computer, and has a paragraph in the employee handbook that says you are never allowed to visit news.ycombinator.com on the work computer. At some point while working at the company, you visit news.ycombinator.com on the work computer. Have you just committed a felony? You&amp;#x27;ve &amp;quot;exceeded the authorized access&amp;quot;, if you interpret &amp;quot;entitled&amp;quot; and &amp;quot;authorized&amp;quot; as broadly as Thomas, Alito, and Roberts seem to. Should that really be a felony?&lt;p&gt;That interpretation leads to such a massive broadening of felony criminal liability. It doesn&amp;#x27;t gut-check for me. That, combined with what I perceive as the better textual reading of the phrases &amp;quot;so&amp;quot; and &amp;quot;entitled&amp;quot;, I have to disagree with you. I think the other 6 justices had the better argument at multiple levels.</text></item><item><author>blakesterz</author><text>I guess this is the part that matters most?&lt;p&gt;&amp;quot;We must decide whether Van Buren also violated
the Computer Fraud and Abuse Act of 1986 (CFAA), which
makes it illegal “to access a computer with authorization
and to use such access to obtain or alter information in the
computer that the accesser is not entitled so to obtain or
alter.”
He did not. This provision covers those who obtain information from particular areas in the computer—such as
files, folders, or databases—to which their computer access
does not extend. It does not cover those who, like Van Buren, have improper motives for obtaining information that
is otherwise available to them&amp;quot;&lt;p&gt;Thomas, Alito and Roberts dissented, and I hate to say it, but I agree with them.&lt;p&gt;&amp;quot;The question here is straightforward: Would an ordinary
reader of the English language understand Van Buren to
have “exceed[ed] authorized access” to the database when
he used it under circumstances that were expressly forbidden? In my view, the answer is yes. The necessary precondition that permitted him to obtain that data was absent.&amp;quot;&lt;p&gt;That&amp;#x27;s Thomas dissenting.</text></item></parent_chain><comment><author>mywittyname</author><text>&amp;gt;  but then ask you not to look in the `Taxes` folder on the desktop should it be a felony for you to open the `Taxes` folder? That conceptually feels wrong to me. I have violated your trust, sure, but I haven&amp;#x27;t committed fraud&lt;p&gt;You accessed privileged information that you were explicitly not allowed.  To me, asking you not to look at certain information is effectively the same as putting a password on it, then having you break it.  In both cases, the intent of the owner is clear: do not access these files.  And in both cases, the actions of the perpetrator very clearly disregard the owners intent.&lt;p&gt;Your example about accessing a website is not the same.  It&amp;#x27;s pretty clear that the person going to new.ycombinator.com is not stealing or accessing privileged information.  There have been separate rulings dealing with whether or not employees can use corporate equipment for personal reasons.&lt;p&gt;A more analogous example to the case at hand would be an employee at Google&amp;#x2F;Humana&amp;#x2F;Tinder selling your private details to a third party.  This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite.&lt;p&gt;Unless, of course, the only reason the court ruled in favor of this person was that they are a police officer.  But I guess we have to wait until the FBI attempts to press charges against someone at Google selling personal details to third parties to find out.</text></comment>