No, Violating Your Employer's Computer Use Policy Is Not Criminal Hacking
from the office-facebookers-everywhere-breathe-a-sigh-of-relief dept
You may remember a story from last year about David Nosal, a man who was essentially convicted of computer hacking because the Ninth Circuit Court of Appeals determined that he "exceeded authorized access" on his employer's computer system when he broke the written rules regarding how data on that system could be used (in this case, by accessing said data before leaving the company for a competitor). Whether or not accessing the data was some other legally actionable offense, its prosecution under the Computer Fraud and Abuse Act (CFAA) set an alarming precedent for the rest of us.As noted at the time, if breaking any arbitrary rule a company places on its IT system is "hacking", then most office workers could be in big trouble. Did you check Facebook using a company computer? You could be charged with criminal hacking if the rules say you shouldn't. To make matters worse, as Orin Kerr argued then, prosecutions like this aren't necessarily limited to desktop computers, since the line for what constitutes a computer is so blurry these days. Did you use your company smartphone to call home and tell your wife that you'll be late for dinner? That's could be good for ten years in prison, if company policy prohibits making personal calls from it.
Of course, this isn't the first time prosecutors have tried to abuse the CFAA. Recall, if you will, the infamous case of Lori Drew, who was prosecuted under the theory that violating a Terms of Service was also the same thing as hacking. Ridiculous, to be sure, but a jury convicted her anyway. That conviction was eventually overturned by the judge in the case, but others haven't been so lucky, and given the last decision by the Ninth, things were looking pretty grim for common sense.
Happily, however, the Ninth decided to re-hear David's case en banc (meaning with all the judges, rather than a small panel of them), and has now reversed the previous ruling. The analysis by the always-entertaining Judge Kozinski makes it perfectly clear where the line is drawn:
We construe criminal statutes narrowly so that Congress will not unintentionally turn ordinary citizens into criminals. [...] This narrower interpretation is also a more sensible reading of the text and legislative history of a statute whose general purpose is to punish hacking—the circumvention of technological access barriers—not misappropriation of trade secrets—a subject Congress has dealt with elsewhere. Therefore, we hold that “exceeds authorized access” in the CFAA is limited to violations of restrictions on access to information, and not restrictions on its use.Since decisions have gone the other way in other circuits, Kozinski goes even further, and says that other courts have "failed to apply the long-standing principle that we must construe ambiguous criminal statutes narrowly" and that they at the Ninth "respectfully decline to follow our sister circuits and urge them to reconsider instead."
Hopefully, other courts will heed this message, but for now, this is a win for everyone on the west coast.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: cfaa, david nosal, hacking, terms of service
Reader Comments
Subscribe: RSS
View by: Time | Thread
Ahh, so that's why Congress is now writing criminal statutes so broadly. I see now!
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Lovely ...
[ link to this | view in chronology ]
Salting the Wound
Sending a tasteless joke via email can certainly be grounds for dismissal, but unless it's hiding or distributing malware, there no hacking involved at all.
[ link to this | view in chronology ]
I do have some issue with this...
[ link to this | view in chronology ]
Re: I do have some issue with this...
[ link to this | view in chronology ]
Re: I do have some issue with this...
[ link to this | view in chronology ]
Re: I do have some issue with this...
Nothing in the post indicates that he went around security features of the corporate network only that he took data with him to his new employer something he could have off-loaded onto a thumb drive or whatever or, even foolishly, zipped up and emailed home.
None of that involves going beyond his normal access except that he took it home to show to his new employer which, until he walks out the door for the last time, breaks his employment contract and his duty of confidentiality.
He didn't have to crack anything to get the data. So what's popularly called "hacking" never enters into it. It sounds more romantic to call it "hacking" but for the most part these sorts of things don't involve that.
[ link to this | view in chronology ]
Re: Re: I do have some issue with this...
The only reason I can see for using the CFAA is to get the taxpayer to pick up the legal costs of enforcing a civil contract that may or may not exist.
[ link to this | view in chronology ]
Thank god...
[ link to this | view in chronology ]