The Supreme Court on Thursday narrowed the reach of a federal anti-hacking law, rejecting a broad interpretation advanced by federal prosecutors it feared would criminalize workaday computer activity.
The question in the case was whether the Computer Fraud and Abuse Act penalizes authorized computer users who use database information improperly. The defendant, Nathan Van Buren, was a Georgia police officer who tried to monetize his access to the state’s license plate database.
A coalition of tech companies, advocacy groups, and journalists warned a broad reading of the act would criminalize whistleblowing, news-gathering activity, and ordinary internet embellishment. Prosecutors, they noted, have applied the statute broadly to charge researchers or internet "cat-fishers" who misrepresent themselves online with federal crimes. The groups expressed relief with Thursday’s decision.
"This is an important and welcome decision that will help protect digital research and journalism that is urgently necessary," said Alex Abdo of the Knight First Amendment Institute. "But more is needed. Congress should amend the Computer Fraud and Abuse Act to eliminate any remaining uncertainty about the scope of the statute."
The Court’s conservatives fractured evenly over Thursday’s case. Justice Amy Coney Barrett delivered the opinion for a six-justice majority that included the liberal trio plus Justices Neil Gorsuch and Brett Kavanaugh. Justice Clarence Thomas dissented, joined by the chief justice and Justice Samuel Alito.
Van Buren approached a local FBI informant for a personal loan in 2015. The informant, acting in concert with the bureau, asked Van Buren to run a license plate search on a woman he met at an area strip club in exchange for $5,000. Van Buren did so from his patrol car interface using official credentials. He was arrested and convicted in federal court of a felony violation of the Computer Fraud and Abuse Act and sentenced to 18 months in prison.
The act makes it illegal to access a computer without authorization or to "exceed authorized access." The federal government argued a person violates that provision if they take information from a computer—even information available to them—and use it improperly. Van Buren was authorized to use the patrol car terminal and the license database, but his use of the system for personal business was improper and therefore, the government said, a crime.
Writing for the Court, Barrett said the statute only addresses instances in which someone accesses information beyond their official ambit.
"This provision covers those who obtain information from particular areas in the computer—such as files, folders, or databases—to which their computer access does not extend," Barrett wrote. "It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them."
A range of amicus (or "friend of the court") briefs urged the Court to construe the statute narrowly. A brief from the Reporters Committee for Freedom of the Press said reporters rely on sources leaking information from government databases all the time. A leak is an improper use that would subject the source to prosecution under the government’s theory, and open reporters who receive such information to a Computer Fraud and Abuse Act conspiracy charge.
Another brief pointed to the 2008 prosecution of a Missouri woman for creating a fake MySpace profile to investigate and harass a student thought to be bullying her daughter. People use computers for all sorts of purposes, the brief said, such that it would be easy for a motivated prosecutor to target an unpopular figure for a crime under the act.
"The power to prosecute people for violating express restrictions on computers is a power to prosecute anyone the government thinks needs prosecuting," the brief reads.
Barrett nodded to those concerns in Thursday’s opinion but emphasized they were not dispositive.
"The government’s interpretation of the statute would attach criminal penalties to a breathtaking amount of commonplace computer activity," Barrett wrote.
"The fallout underscores the implausibility of the government’s interpretation," she added. "It is ‘extra icing on a cake already frosted.’"
The case is No. 19-783 Van Buren v. U.S.