The Supreme Court on Monday restricted the scope of a federal anti-hacking law, with the majority of justices saying the government’s “breathtaking” interpretation of the statute could make criminals of “millions of otherwise law-abiding citizens.”
The immediate beneficiary was Nathan Van Buren, a former police officer in Cumming, Ga. Van Buren was paid about $5,000 by an acquaintance to use his official computer access to track down information on a woman the man had met at a strip club. Van Buren later learned the 2015 payment, from someone police officers had been warned to steer clear of, was part of a sting operation.
Van Buren’s conduct violated department policy, Barrett wrote, but the question for the court was whether it also violated the Computer Fraud and Abuse Act of 1986. The law makes it illegal to “access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.”
Barrett wrote that Van Buren’s activities do not meet the definition.
The provision “covers those who obtain information from particular areas in the computer — such as files, folders, or databases — to which their computer access does not extend,” she wrote. “It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them.”
But the greater importance of the case was how it might affect the now-ubiquitous use of computers in the workplace.
Those supporting the government warned that a narrow reading of the Computer Fraud and Abuse Act of 1986 could protect those who accessed and released corporate secrets, or used the information for nefarious purposes.
But those backing Van Buren complained the government’s broad reading could imperil workers who used their company laptops for activities such as checking social media or shopping for shoes. Journalists, civil rights activists and whistleblowers told the court a broad reading could diminish the ability to expose wrongdoing.
Barrett and the majority said the text favored the narrow reading, but mentioned the consequences as well.
“The government’s interpretation of the statute would attach criminal penalties to a breathtaking amount of commonplace computer activity,” Barrett wrote, potentially criminalizing “everything from embellishing an online-dating profile to using a pseudonym on Facebook. ”
In the workplace, she wrote, “employers commonly state that computers and electronic devices can be used only for business purposes. So on the government’s reading of the statute, an employee who sends a personal e-mail or reads the news using her work computer has violated the CFAA.”
Barrett wrote for Breyer and his fellow liberal justices Sonia Sotomayor and Elena Kagan, as well as her fellow Trump nominees, Neil M. Gorsuch and Brett M. Kavanaugh.
Justice Clarence Thomas dissented, along with Chief Justice John G. Roberts Jr. and Justice Samuel A. Alito Jr.
“Both the common law and statutory law have long punished those who exceed the scope of consent when using property that belongs to others,” Thomas wrote. “A valet, for example, may take possession of a person’s car to park it, but he cannot take it for a joyride.”
Likewise, Thomas wrote: “Van Buren never had a ‘right’ to use the computer to obtain the specific license plate information. Everyone agrees that he obtained it for personal gain, not for a valid law enforcement purpose. And without a valid law enforcement purpose, he was forbidden to use the computer to obtain that information.”
Thomas acknowledged that his interpretation of the law could subject many common practices to the CFAA. But that was nothing new, he wrote: “The number of federal laws and regulations that trigger criminal penalties may be as high as several hundred thousand.”
He mentioned laws that punish a person “who removes a single grain of sand from the National Mall,” breaks a lamp in a government building or permits a horse to graze on federal land.
“It is understandable to be uncomfortable with so much conduct being criminalized, but that discomfort does not give us authority to alter statutes,” he wrote.
The opinion reverses a decision of the U.S. Court of Appeals for the 11th Circuit that upheld Van Buren’s conviction and sentence of 18 months in prison.
The case is Van Buren v. United States.