The Supreme Court Is Being Asked To End Questionable CFAA Prosecutions
from the but-will-it? dept
The Supreme Court is being asked to resolve a circuit split on the reach of the Computer Fraud and Abuse Act. The CFAA has done a lot of damage to security researchers and others who violate terms of service agreements. The "others" include everyday Americans who have no idea they might be violating federal law when they do things like give fake information to social media companies or use work computers for personal reasons.
The CFAA case SCOTUS is being asked to look at involves something a bit more serious than that. It deals with a police officer who took money to search a license plate database for someone who had no legal access to it. Here's a brief description of what triggered the prosecution from the Eleventh Circuit Appeals Court.
During the interview [with the FBI], Van Buren admitted he had concocted a fake story about his son’s need for surgery to justify asking Albo for $15,000. He also conceded he had received a total of $6,000 from Albo. In addition, Van Buren confessed he had run a tag search for Albo and he knew doing so was “wrong.” And while Van Buren asserted that $5,000 of the money he received from Albo was a “gift,” he did reply “I mean he gave me $1,000” when asked if he received anything in exchange for running the tag. Finally, Van Buren conceded he understood the purpose of running the tag was to discover and reveal to Albo whether Carson was an undercover officer.
The Appeals Court tossed out the honest services fraud charge but left the CFAA conviction intact. The end result was a split with other circuits which have declared simply violating a site or system's terms of service cannot trigger criminal charges under the CFAA.
Here's why the case is important, as summarized by Orin Kerr for the Volokh Conspiracy:
The split is clear and acknowledged, and it's crazy important. The CFAA either makes most people or very few people criminals. Indeed, I have testified under oath that I am a criminal in the Eleventh Circuit. I violate Facebook's terms of service by giving a false location, which according to the DOJ and the Eleventh Circuit is a federal crime every time I visit Facebook. You probably ignore terms of service, too. So the stakes are pretty high. The stock line I have when I lecture about the CFAA is that no one can know what the statute means until the Supreme Court finally resolves the split. And I've been offering that line for years, as the split has lingered without being resolved.
This case has the potential to decriminalize acts that should never have been criminalized in the first place. The DOJ has stated it won't pursue prosecutions for mere terms of service violations and yet here's a case where it's doing exactly that. The underlying facts suggest something far more troubling than lying about your exact location when logging into a social media service, but it's the broad reading of the CFAA by the Eleventh Circuit that threatens to do a lot of damage to computer users around the nation. This is the reading the DOJ pursues in that jurisdiction and it will apparently continue to do so until told otherwise.
And it doesn't want to be told otherwise. The DOJ is asking the Supreme Court to take a pass on this case and allow it to pursue questionable CFAA prosecutions in any circuit where this remains unresolved. The DOJ may promise to use its prosecution powers with more discretion when its prosecutorial tactics are challenged in court (as in this case before the DC Appeals Court) but the facts of this case don't bear that out. It has been more than happy to abandon cases in other circuits where rulings have forbidden prosecutions for broad readings of unauthorized access. But in the circuits where it can still get away with it, it still pursues these prosecutions it tells other circuits it's not interested in pursuing.
No one wants to see a crooked cop cut loose because the government chose to pursue a prosecution under a badly-written law. But we don't want to see a bunch of people far less odious than this particular officer prosecuted by the DOJ for far more innocuous activities.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: cfaa, scotus, supreme court, terms of service, van buren
Reader Comments
Subscribe: RSS
View by: Time | Thread
Why decide?
They want to keep the flexibility to "go after" who they want, regardless. As my grandfather (a cop) used to say, "I can arrest anyone, anytime, and there'll be a law to support it. Depends on how much they piss me off."
[ link to this | view in chronology ]
Re: Why decide?
Some police forces do not think such behaviour is acceptable
[ link to this | view in chronology ]
Some police forces...
Sadly those who find themselves confronted by law enforcement do not get to choose which law enforcement points guns at them.
So even one bad apple spoils the barrel, so to speak.
[ link to this | view in chronology ]
Lets pass another one.
All laws/regs now inserted into our gov. have to be prosecuted from the Top down..
First the regulators, then the Congress and rep, then the rich and corps.
As soon as we do this, it should clear up allot of little things, quickly.
How many of the above, have any idea of 'What is', and what happens with enforcement if idiocy/bad laws that they dont Understand how they will work.
Great video of People <20, introduced to an old rotary phone. asked how to use it.
About the same idea of reading all of a TOS and attachments and contracts to use a site. And the idea that after age 40, and reading all the crap Corps send you(thanks PCH), that you get tiered of reading all the Junk.
[ link to this | view in chronology ]
I must not understand this
"The Appeals Court tossed out the honest services fraud charge but left the CFAA conviction intact."
This can't mean that taking money to do something for somebody that (and he knew doing so was “wrong”) is legal. Can it?
[ link to this | view in chronology ]
Re: I must not understand this
No, according to the decision, the fraud conviction is being vacated in favor of a new trial because the appeals court determined jury instructions were flawed.
[ link to this | view in chronology ]
In the long run.
What are the odds...
That the USA has the Oldest computer in full use by a gov.?
Is there a reason that the Internal tech of our country is based and run by computers BEFORE the 8086 chipset?? And for SOME real strange idea, there is no way to take this computer OUT of the works and Install something about 100,000 times faster and better built?
https://www.dontmesswithtaxes.com/2019/04/irs-technology-upgrade-will-require-up-to-2-point-7 -billion.html
"IRS unveils upgrade plan: Uncle Sam's tax collector has developed a six-year strategy to modernize IRS Information technology (IT) systems and build the infrastructure the agency needs to move forward in our ever-changing digital world."
And in 6 years, they will be using the Current standard, not the one for 6 years ahead.
It used to be nice when the gov. asked Everyone to submit Contracts for doing things and would get some Very good prices. NOW we used only specific corps, that screw us EVERY TIME.. But still the heart of the Whole thing seems to be a Major computer with 1959-60 Programming.
[ link to this | view in chronology ]
Wow, dude, that's one bad flashback you had there.
'Cause, like, if only the IRS had used some "better-built" computers using the "8086 chipset" (like the IBM PC-AT), I guess they wouldn't be in this fix now?
Dude, the problem ain't hardware. It's software. Like, it don't matter how old your bong is, if the weed is fresh. And bongs are like, cheap, but weed is expensive.
Only, software isn't quite like weed--more like mulch. It's easier to add fresh manure that it is to reconstruct the whole mulch pile. And the IRS has been adding cow-patties from tax-law changes for all these years. If they change hardware, they'll have to reconstruct the whole pile. Lots of work: complicated work, too, not anything you could do in a drunken stupor.
Of course they'll pay too much for it. Of course they won't get what they paid for.
But the only other option is to build their own software development company: and, face it, the civil service regs effectively keep the government from recognizing good programmers. (And how many good programmers would want to spend their lives programming tax computations anyway? All the usual motivations fail: low pay, lower prestige, bureaucratic infighting without the thrill of technical achievement or social benefit.
[ link to this | view in chronology ]
Re:
well lets go ask an 8bit machiune about the size of its hard drive, the Max ram it can have, and if(in the 1990's, the Client side 386's(when we all had Pentiums) was doing any good when the main system was Slower then their Home based machines..
The systems they have are so, behind, that it became the ideal to track LOW income people then to EVEN TRY going thru the Corp Mess.And the story behind that is real Fun. Took congress 3 years to OK the purchase, and by that time, Computers had Improved, by the Bidder installed the OLD hardware and made a bundle.
And what do you think they Pay the Computer programmer that keeps that thing alive.
[ link to this | view in chronology ]
I love your visual demo.
Thank you. Your response has been very helpful.
In an age of newspapers going out of business...
I do appreciate all clear demonstration in areas out of my expertise.
Have a great day!
[ link to this | view in chronology ]
As per usual...
...in its resistance to defining the parameters of existing law, the DOJ is demonstrating it is not interested in serving the good of the people rather than merely discharging its strength, perhaps to the personal benefit of officials within the DOJ.
[ link to this | view in chronology ]
Why this case?
I would imagine this is explicitly what the CFAA is all about - using a commercial computer service to obtain and pass on private individuals' information to a third party, when the terms under which you are allowed on the computer are explicit. What's surprising is not that the prosecute under the CFAA but that there is not a more explicit law about privacy. I recall a case over 20 years ago where a policeman in Vancouver was disciplined for looking up car ownerships on the provincial database to pass on the owner information to an anti-abortion group for cars parked near an abortion clinic. We regularly hear about people charged for being nosy about the medical database information on friends and neighbours. I think that level of terms violation exceeds the level of claiming you live somewhere else for a chat site. If they are equivalent then... what else... the CFAA is a poorly written law.
Is the CFAA really the best the system can do against bribery and disclosure of identity of an undercover cop?
OTOH, when those two Russian bumblers poisoned the dissident in Britain and his daughter, one of the obvious pieces of information was that one had his personal vehicle registered to their Moscow police headquarters address...
[ link to this | view in chronology ]
Qualified immunity?
[ link to this | view in chronology ]
While I disagree that this is a criminal offense, officers who search license plate numbers that are subject to a current investigation should automatically trigger an Internal Affairs investigation. The officer should have been fired and banned from serving in any law enforcement role in his locality, let alone, the state.
[ link to this | view in chronology ]