U.S. Supreme Court building.

The U.S. Supreme Court has agreed to settle an intra-circuit dispute as to whether an authorized user of a computer system commits a criminal act by using it for an improper purpose. 

The justices Monday granted certiorari in the case of a police officer in Cumming, Georgia, convicted of computer fraud after he was paid to access a statewide criminal database to see whether a woman, who  an acquaintance was purportedly interested in dating, was an undercover officer.

Upholding his conviction on that charge, the U.S. Court of Appeals for the Eleventh Circuit in October agreed with several other circuits that such an improper use constitutes a violation of Computer Fraud and Abuse Act and allowed his 18-month prison sentence to stand.

But lawyers for ex-cop Nathan Van Buren argued that the interpretation embraced by the trial court and appellate panel is far too narrow, pointing out that such a reading could make it a crime for someone to check their bank balance or follow an office sports pool on their company-issued computer. 

Appellate courts are "intractably divided," with four circuits maintaining that someone with permission to use a computer does so for an "improper purpose" while three more say the act only criminalizes such access if there is no authority to access it at all. 

Such a reading would "criminalize ordinary computer use throughout the country," wrote Van Buren's lawyers, Federal Defenders Stephanie Kearns and Rebecca Shepard; Atlanta solo Saraliene Durrett and Jeffrey Fisher with the Stanford Law School Supreme Court Litigation Clinic. 

"We're grateful for the court's willingness to review the case and look forward to making our arguments on the merits," said Fisher via email.

There was no immediate response from the office of Solicitor General Noel Francisco.

As detailed in court filings, Van Buren was a sergeant with the Cumming department who struck up a friendship with a man named Edward Albo, a retiree in his 60s who "allegedly fancied younger woman, including minors and prostitutes," whom he would pay only to later accuse them of stealing his money.

Van Buren's chief had warned his officers that Albo was mentally unstable and "volatile," but the sergeant nonetheless "often handled the disputes between Albo and various women."

At some point Van Buren asked Albo to loan him  $15,368, claiming he needed to pay his son's medical bills.

Albo secretly recorded the conversation, then reported the incident to a Forsyth County Sheriff's detective, saying Van Buren was shaking him down. 

The Federal Bureau of Investigation got involved, and they set up a sting in which Albo told Van Buren he was interested in a woman he met at a strip club but was afraid she was an undercover cop. 

Albo gave Van Buren $5,000 and provided a phony license number the FBI provided; he later gave the officer another $1,000.

Van Buren ran the number through the Georgia Criminal Information Center database and told Albo he had some information for him.

The next day, agents of the Georgia Bureau of Investigation and FBI showed up at Van Buren's doors, and he admitted having run the number for Albo.

In 2016, a federal grand jury indicted Van Buren on one count of honest-services wire fraud and one count of felony computer fraud. District Judge Orinda Evans sentenced him to two 18-month terms, to be served concurrently, and another two years on probation upon release. 

Van Buren appealed both convictions, and in October an Eleventh Circuit panel agreed that the trial judge issued flawed jury instructions regarding the honest-services charge, and ordered that he be granted a new trial on that count. 

He also challenged the computer fraud statute, arguing that "he was innocent because 'he accessed only databases that he was authorized to use,' albeit for inappropriate reasons."

Eleventh Circuit Judge Robin Rosenbaum, writing for a panel that included Judge Beverly Martin and Sixth Circuit Judge Danny Boggs, rejected that argument.

"We noted that the Computer-fraud statute defines 'exceeds authorized access,' as 'to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled [so] to obtain or alter,'" she wrote. The officer violated the law when he obtained the information "for a nonbusiness reason." 

"Van Buren points out that our sister circuits have criticized [prior circuit precedent] since it purportedly allows employers or other parties to legislate what counts as criminal behavior through their internal policies or their terms of use," Rosenbaum said. 

She acknowledged that other circuits have warned that such an interpretation could leave open the possibility of someone facing criminal charges for chatting on Google, playing games or viewing Facebook at work.

"But under our prior-precedent rule, 'a prior panel's holding is binding on all subsequent panels unless and until it is overruled or undermined to the point of abrogation by the Supreme Court or by this court sitting en banc,'" Rosenbaum wrote. 

In asking the Supreme Court to do just that, Van Buren's lawyers wrote that it is "critical that this court resolve the conflict over the scope of the CFAA."

"At its core, the question presented is whether the CFAA applies only to hacking and related activities or whether it extends to 'whole categories of otherwise innocuous behavior,'" they wrote. 

"[M]ost everyone who uses a computer (which is to say, most everyone) regularly runs up against conditions on accessing information on the computer," their petition said. 

"For example, many law schools provide students with access to the Westlaw legal database for educational use only. But a student might use that access for personal purposes—perhaps to look up local housing laws to negotiate rent or to demand a refund of a security deposit."

Every March, they said, "tens of millions of American workers participate in office pools for the NCAA men's basketball tournament ('March Madness'). Such pools typically involve money stakes. When these employees use their company computers to generate their brackets or to check their standing in the pools, they likely violate their employers' computer policies.

"Again, the answer to the question presented determines whether these employees are guilty of a felony," it said. 

"The question whether such commonplace activities violate the CFAA should not be left unresolved," Van Buren's petition said. "It is intolerable for a broad swath of conduct to be entirely innocent in parts of the country but to constitute a federal crime in others."

Bolstering their petition were amicus briefs, one filed by The National Association of Criminal Defense Lawyers and another by the Electronic Frontier Foundation, Center for Democracy & Technology, and New America's Open Technology Institute.