Supreme Court Clarifies 'Exceeding Authorized Access' Under CFAA: So Much Depends on 'So'
Stephen M. Kramarsky reviews 'Van Buren v. United States', in which the Supreme Court resolved a Circuit split by narrowly construing the "exceeding authorized access" clause of the CFAA.
July 26, 2021 at 12:45 PM
11 minute read
Cybercrime and hacking are much in the news recently, and the recent wave of ransomware attacks reminds us of how our dependence on heavily networked and interconnected systems can leave even our most critical infrastructure vulnerable to attack. Numerous federal and state statutes seek to provide protection against this kind of activity, but even leaving aside enforcement issues (which can be substantial, particularly for conduct that originates outside the United States) courts have struggled to interpret the precise scope of these laws. While most people have some idea of what "computer hacking" is, defining it with the specificity necessary to impose criminal liability has sometimes turned out to be a challenge.
For example, most federal criminal prosecutions for "hacking" (as that term is generally understood) are brought under the Computer Fraud and Abuse Act (the CFAA), 18 U.S.C. §1030, which covers a broad range of misconduct relating to networked computer systems. Violations of the CFAA can lead to both civil and criminal liability, so the statute attempts to draw bright lines defining its scope. Nonetheless, the courts within the Federal Circuit have disagreed substantially about what conduct the statute actually prohibits—at least at the margins.
Broadly speaking, the CFAA prohibits online misconduct in several categories: obtaining unauthorized access to a system (or exceeding authorized access to a system) and thereby improperly gaining access to protected information, damaging computer systems (either by unauthorized access or by transmitting malicious code), trafficking in passwords and code used for unauthorized access, and extortion or threats related to the prohibited conduct. Although the prohibited conduct is broadly defined, the "access" prohibitions are aimed at a person who "intentionally accesses a computer without authorization or exceeds authorized access." The issue, for many courts, has been the meaning of "exceeding authorized access." If a Netflix subscriber shares their password with a roommate in violation of Netflix's terms of service, is the roommate subject to federal criminal prosecution under the CFAA? The access is "authorized" in the sense that the password is valid and the roommate has the subscriber's permission, but it "exceeds" the authorization set out in the terms of service. Is that contract violation also a federal crime?
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
Trending Stories
- 1The Law Firm Disrupted: For Big Law Names, Shorter is Sweeter
- 2Wine, Dine and Grind (Through the Weekend): Summer Associates Thirst For Experience in 'Real Matters'
- 3'That's Disappointing': Only 11% of MDL Appointments Went to Attorneys of Color in 2023
- 4What We Know About the Kentucky Judge Killed in His Chambers
- 5'I'm Staying Everything': Texas Bankruptcy Judge Halts Talc Trials Against J&J
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250