Supreme Court Narrows Computer Hacking Law

The U.S. Supreme Court this morning adopted the narrower of two interpretations of the Computer Fraud and Abuse Act of 1986’s prohibition of what is commonly known as “hacking.” Justice Barrett wrote the opinion for the six-Justice majority.

Nathan Van Buren, a former police sergeant, ran a license-plate search in a law enforcement computer database in exchange for money. Van Buren’s conduct plainly flouted his department’s policy, which authorized him to obtain database information only for law enforcement purposes. We must decide whether Van Buren also violated the Computer Fraud and Abuse Act of 1986 (CFAA), which makes it illegal “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.”

He did not. This provision covers those who obtain information from particular areas in the computer—such as files, folders, or databases—to which their computer access does not extend. It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them.

Justice Thomas dissented, joined by Chief Justice Roberts and Justice Alito.

Both the common law and statutory law have long punished those who exceed the scope of consent when using property that belongs to others. A valet, for example, may take possession of a person’s car to park it, but he cannot take it for a joyride. The Computer Fraud and Abuse Act extends that principle to computers and information. The Act prohibits exceeding the scope of consent when using a computer that belongs to another person. Specifically, it punishes anyone who “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains” information from that computer. 18 U. S. C. §1030(a)(2).

The case is Van Buren v. United States, No. 19-783. That’s all for today. The next likely decision day is Monday.

For those who like to categorize Justices and tally statistics, it may (or may not) be noteworthy that the six Justices appointed by Republican Presidents split by age, with the three younger ones supporting the narrower interpretation of this criminal law. There is perhaps a more libertarian streak in the more junior Justices and more wariness of over-criminalization and over-federalization.

In this case, Van Buren’s conduct should be a crime, but it need not be a federal one. The fact that he used a computer is immaterial, in my opinion. The essence of what he did wrong was use law enforcement information for private gain. It would have been just as wrong if he had taken the information in hard copy out of a file cabinet.