Supreme Court narrows scope of computer fraud law

Unusual Supreme Court majority narrows scope of computer anti-hacking law

June 3, 2021 Updated 12:21 PM PT

WASHINGTON — The Supreme Court limited the scope of the federal law against computer hacking on Thursday, ruling it covers those who break into confidential files, but not people who misuse the information they are authorized to see.

In a 6-3 opinion written by Justice Amy Coney Barrett, the court said it would not turn “millions of otherwise law-abiding citizens” into criminals if they sit at their work computer and send personal notes to friends or plan a vacation.

At issue, she said, were so-called inside hackers who have legal access to a computer, but then exceed their authorized use by using the information for other purposes. She said the court would not interpret the phrase “exceeds authorized access” to criminalize every violation of a computer-use policy.

The decision overturns the computer fraud conviction of a Georgia police sergeant who was authorized to check the state’s database on license plates, but took a $5,000 secret payment from a local man who said he wanted to learn about a stripper he had just met. It was actually an FBI sting, and Nathan Van Buren, the sergeant, was charged and convicted of a computer fraud for exceeding his “authorized access.”

He appealed, arguing that he was authorized to check the state license plate files. The court’s majority agreed with Van Buren that the law in question did not apply to his circumstances.

“An individual ‘exceeds authorized access’ when he accesses a computer with authorization, but then obtains information located in particular areas of the computer — such as files, folders, or databases — that are off limits to him,” Barrett wrote.

Van Buren accessed the law enforcement database system with authorization, she said, “even though he obtained information from the database for an improper purpose.”

The court’s three Trump appointees and its three liberal Democratic appointees formed the majority.

Joining Barrett’s opinion in Van Buren vs. United States were Justices Stephen G. Breyer, Sonia Sotomayor, Elena Kagan, Neil M. Gorsuch and Brett M. Kavanaugh.

In dissent, Justice Clarence Thomas said the laws “have long punished those who exceed the scope of consent when using property that belongs to others. A valet, for example, may take possession of a person’s car to park it, but he cannot take it for a joyride.” Chief Justice John G. Roberts Jr. and Justice Samuel A. Alito Jr. agreed.

The ACLU welcomed the decision as “an important victory for civil liberties and civil rights enforcement in the digital age.” The group had long challenged the broader view of the computer fraud law that it said “would create criminal and civil liability for researchers and journalists who violate website terms of service while undertaking civil rights testing and research online.”

Others said Congress needs to update the law. “Given the central role and value of data in today’s commerce and society, it is time to modernize the primary federal computer statute to ensure that appropriate criminal and civil remedies apply to the theft of data,” said Palo Alto lawyer Mark Krotoski, a former federal prosecutor.

Van Buren resigned from his police job in Cummings, Ga., after he was indicted for bribery and computer fraud. He was convicted on both counts and sentenced to 18 months in prison in 2018.

However, the 11th Circuit Court in Atlanta overturned the bribery charge, and the Supreme Court has now reversed his conviction for computer fraud.