The U.S. Supreme Court on Thursday said a Georgia police officer had not violated the country’s main anti-hacking law by improperly accessing a government database for financial gain, a decision likely to curtail prosecutions under the Computer Fraud and Abuse Act (CFAA) of individuals who misuse computer systems to which they have legal access.
The police officer, Nathan Van Buren, was arrested and charged under the 1986 law after accepting payment from an FBI informant to search a law enforcement database of license plate information. The government charged Van Buren with violating the CFAA, which prohibits people from knowingly “exceeding” their “authorized access” to a computer system.
The ruling is widely viewed as a win for criminal defense lawyers who’ve long criticized the statute as overly ambiguous and who’ve accused prosecutors of employing an overly expansive interpretation. The government has previously brought charges under the CFAA against people accused of violating corporate computer policies and website terms of service.
The ruling is “an important victory for civil liberties and civil rights enforcement in the digital age,” the American Civil Liberties Union said.
In its 6-3 decision, the Supreme Court found Van Buren’s use of the license plate database—however improper—was not “unauthorized,” insofar as the CFAA is concerned.
“In sum, an individual ‘exceeds authorized access’ when he accesses a computer with authorization but then obtains information located in particular areas of the computer—such as files, folders, or databases—that are off limits to him,” the court’s opinion, delivered by Justice Amy Coney Barrett, says.
Barrett went on to note the government has never argued that Van Buren was prohibited from accessing the database, even if his motives for doing so, in this case, were immoral. “The only question is whether Van Buren could use the system to retrieve license-plate information. Both sides agree that he could,” she wrote.
Chief Justice John Roberts and Justices Clarence Thomas and Samuel Alito dissented.
The CFAA first arose as a topic of national debate in earnest in late 2011 after the Justice Department indicted Aaron Swartz, a young technology activist, for downloading a large number of academic journals from MIT’s computer network. He was charged, among other counts, with accessing MIT’s network “in excess of authorized access.”
A programming prodigy who invented the software behind RSS at age 14, Swartz died by suicide two years later. His father would later accuse federal prosecutors of hounding his son to death, calling the pursuit “a complete miscarriage of justice.”
David Segal, a former Rhode Island state lawmaker, with whom Swartz co-founded the digital rights group Demand Progress, said the 26-year-old “took his life...while being threatened with decades in prison under an absurd and overly broad interpretation” of the CFAA.
“Nothing can ever bring back Aaron, or the gifts that his unique talents and prolific work ethic would have brought to this world. Still, we are pleased that a small sliver of justice has been delivered today by the Supreme Court’s ruling to restrict the scope of the CFAA,” Segal said.
“The Supreme Court’s decision will allow researchers and journalists to use common investigative techniques online without fear of CFAA liability,” said Esha Bhandari, deputy director of the ACLU’s speech, privacy, and technology project. “It clears away a major barrier to online anti-discrimination testing and research, which is necessary to hold powerful companies and platforms accountable.”
Sen. Ron Wyden, a Democrat of Oregon who co-sponsored legislation to reform the CFAA in the wake of Swartz’s death, condemning it as “inconsistently and capriciously applied,” said the Supreme Court had affirmed the alarming malleability with which prosecutors had wielded a “terribly written” law.
“Today’s ruling helps rectify the damage caused by that reactionary law,” he said.
Wyden—author of the Mind Your Own Business Act—said the case further underscored an urgent need in Congress to pass comprehensive privacy legislation, and to shield users from employees “who abuse their access to databases of sensitive personal information.”
“Earlier this year, we marked the eighth anniversary of the passing of our friend and co-founder Aaron Swartz,” “An incredible young man who left us much too soon, his legacy as an activist and technologist lives on, inspiring countless thousands across the world to this day and catalyzing Demand Progress’s ongoing fight for democracy and justice.”
Update, 1:30pm: Statements added from the ACLU characterizing the ruling.
Update, 2:20pm: Statement by Sen. Ron Wyden added.
Update, 6:00pm: Statement by David Seagal added.
Correction: A previous version of this article named Justice Neil Gorsuch among the dissenters. He ruled with the majority.