The Computer Fraud and Abuse Act (CFAA), a federal law, makes it illegal to use a computer in a way that “exceeds authorized use.” But what does that mean? A recent case provides some guidance.
In the case, Van Buren v. United States, a Georgia police officer took a bribe to run a license-plate check. An undercover Federal Bureau of Investigation (FBI) agent contacted the officer with an interesting offer: run a license-check for me and I will pay you thousands. The officer allegedly agreed. Based on this agreement, the government charged the officer with two counts of fraud: computer fraud under the CFAA and wire fraud.
The main issue in this case is the fact that the officer’s official duties include running license checks, but the officer used this authority in a way the prosecution claims exceeded his authority. As such, they argue his offense was serious enough to support federal criminal charges of a violation of the CFAA.
The arguments were interesting enough that the highest court in our country agreed to hear the case. Upon review, the Supreme Court of the United States (SCOTUS) stated that we must be careful because too broad of an interpretation would result in massive consequences. Instead, Justice Amy Coney Barrett wrote for the court and explained that the narrower interpretation was best: a user violates the CFAA if they access information they were not entitled to obtain. If otherwise entitled, as was true in this case, the user has not violated the CFAA.
Interestingly, one of the key arguments discussed at length in the case is the use of the word “so” in the law. In the relevant portion, the law defines “authorized access” as access and the use of “such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” The government argued the lawmakers’ use of the word “so” in this context meant users commit a crime if they use information in a way that exceeds their authority. Justice Barrett points out that such an interpretation would result in a law that could lead to criminal charges for a multitude of activities. She uses the example of using a pseudonym on Facebook in violation of the site’s policies as a potential offense. This, she explains, goes beyond the lawmakers’ intent, and further supports SCOTUS’ narrow interpretation of the law. This focus on a single word to help sway the court’s opinion is one example of the need for experts when trying to build a case.
It is also important to note that the case provides clarity on one law that governs how we can use computers and when that use rises to the level of criminal activity. In this case, for example, Van Buren likely still faces other criminal charges, such as violating police department computer-use rules. Those who find themselves facing similar allegations of criminal activity are wise to seek legal counsel to review the impact of these and other laws and better ensure a defense strategy tailored to their specific situation.