We post news and comment on federal criminal justice issues, focused primarily on trial and post-conviction matters, legislative initiatives, and sentencing issues.

SUPREMES SCRAPE THE EXCESS ICING OFF THE COMPUTER FRAUD STATUTE

The Supreme Court yesterday fired a shot across the Government’s bow, rejecting the Dept. of Justice’s expansive reading of the Computer Fraud and Abuse Act to criminalize almost everything. The decision is notable not only for declaring that prosaic misconduct is not a federal felony, but for what it portends for other sweeping applications of federal criminal law by DOJ.

Nathan Van Buren was a cop who was indebted to a loan shark. After the FBI got wind of the relationship (the loan shark was cooperating with the Feds), it convinced the shark to get Nate to run a license plate through the law enforcement system in exchange for some debt forgiveness. Nate did so, and the Feebs had their man.

Nate was charged under the Computer Fraud and Abuse Act, 18 USC 1030(e)(6), which criminalizes breaking into a computer without authorization as well as conduct that “exceeds authorized access” of a computer. The statute defines that term as meaning “to access a computer with authorization and to use such access to obtain… information… that the accesser is not entitled so to obtain.” Nate was convicted because while he was authorized to use the license-plate search program for official purposes, he was not authorized to run plates for his own profit and amusement. He got 18 months.

The question the Supreme Court addressed in Van Buren may seem a little technical, whether users violate that statute by accessing information for improper purposes or instead whether users violate the statute only if they access information they were not entitled to obtain.

The Supremes, with junior Justice Amy Comey Barrett writing, said the CFAA only makes it a crime to access information a user is not entitled to obtain. She wrote that the key to understanding the statute is that the user exceeds authorized access only by obtaining information “that the accesser is not entitled so to obtain.” She cited Black’s Law Dictionary, among others, for the proposition that the word “so” is “a term of reference that recalls ‘the same manner as has been stated.’” Under that reading, the sole question is “whether one has the right, in ‘the same manner as has been stated,’ to obtain the relevant information.”

What the CFAA prohibits is obtaining “information one is not allowed to obtain by using a computer that he is authorized to access,” the majority said, rejecting the government’s argument that the circumstance under which it is obtained – think of a cop running a plate on a car he’d pulled over versus running a plate on a strange truck parked in his girlfriend’s driveway – was what made the access illegal or not.

The Court noted only in passing the main topic that had dominated the amicus filings and much of the time at oral argument in this case: the “breathtaking amount of commonplace computer activity” that the government’s reading would criminalize. For the majority, that reality “underscores the implausibility of the Government’s interpretation,” which provides (in words Justice Elena Kagan coined in an earlier case) “extra icing on a cake already frosted.” Justice Barrett noted that extending the statute to “every violation of a computer-use policy” would make criminals of “millions of otherwise law-abiding citizens,” offering examples of such trivial conduct as “embellishing on online-dating profile” and “using a pseudonym on Facebook” – activities that violate website use restrictions and thus would fall within the government’s understanding of the CFAA.

There was an interesting liberal-conservative split in the 6-3 decision. The majority included the liberal wing, Justices Sotomayor, Kagan and Breyer, as well as Gorsuch and Kavanaugh, two more conservative Justices. That left Chief Justice John Roberts and conservative Justices Alito and Thomas in the dissent.

Careful textualism in interpreting federal criminal statutes is a good thing. Now, if the Court would only take up aggravated identity theft…

Perhaps less should be made of the “liberal” and “conservative” labels on the Court.

Van Buren v. United States, Case No. 19-783, 2021 U.S. LEXIS 2843 (June 3, 2021)

– Thomas L. Root