The U.S. Supreme Court heard oral arguments on Monday in a case with wide-ranging implications for the future of the internet and computer use in the United States.
The case stylized as Van Buren v. United States concerns a Georgia police officer named Nathan Van Buren who was convicted under the Computer Fraud and Abuse Act (CFAA) of 1986, a federal criminal statute written well before the U.S. Congress understood computer systems and the upcoming digitization of everyday life, by searching for information about a sex worker at the behest of an undercover federal agent conducting a sting operation.
In 2017, Van Buren was also convicted of wire fraud, which was later overturned by the Eleventh Circuit Court of Appeals. The appellate court, however, upheld the officer’s CFAA conviction based on his “exceed[ing] authorized access” of a computer system. Precedent in the circuit finds that absolutely any derivation from a computer system’s terms of service (TOS) qualifies as an “unauthorized” access under the statute–a capacious understanding of the law that would render most Americans federal criminals.
In practice and plain terms, the CFAA is essentially a bootstrapping measure which stacks on penalties for things that are already crimes simply because a computer is used in the commission of said crime.
Berkeley Law Professor Orin Kerr summed it up as follows:
I have testified under oath that I am a criminal in the Eleventh Circuit. I violate Facebook’s terms of service by giving a false location, which according to the DOJ and the Eleventh Circuit is a federal crime every time I visit Facebook.
The Eleventh Circuit’s decision produced a chasmic circuit split because the Second Circuit and the Ninth Circuit have both rejected that liberal understanding of what qualifies as unauthorized access under the CFAA. On Monday, the Supreme Court was given its first opportunity to opine upon and interpret the scope and constitutionality of the highly–and–often–criticized statute.
Organized journalists and pro-transparency activists are unanimous in their view that the Eleventh Circuit’s take on the law is a threat to whistleblowers, journalism and the First Amendment itself.
An amicus brief in support of Van Buren’s position, one of over a dozen such briefs opposed to the wide-ranging view, filed by online news outlet The Markup warns that the “newsgathering techniques that make data journalism possible could be effectively outlawed by the broad reading of the CFAA that the government urges and that the Eleventh Circuit endorsed” and the organization’s Editor-in-Chief Julia Angwin has termed the statute an “outdated anti-hacking law.”
The high court appeared largely skeptical of the government’s position on Monday afternoon.
Assistant to the Solicitor General Eric J. Feigin struggled to convince any of the nine justices that the government’s position was correct. Meanwhile Van Buren’s attorney Jeff Fisher clearly convinced both Justice Sonia Sotomayor and Justice Neil Gorsuch that the CFAA was on shaky constitutionally ground. Several other justices also appeared to lean in the petitioner’s direction as well.
Sotomayor, at one point, gave Van Buren’s attorney exactly what he wanted to hear in the form of a question as to whether the sort of conduct that prompted the prosecution in the first place could easily into other federal criminal statutes. Fisher quickly agreed by noting that this is exactly what happened in his client’s case.
Gorsuch, firmly ensconced in a much different judicial philosophy, echoed the left-wing justice by noting that “there are ample state laws” which already criminalize such behavior and that don’t require a vast enlargement of federal criminal liability and jurisdiction–a point he would return to repeatedly throughout the session.
Justice Brett Kavanaugh explicitly followed up on Gorsuch’s line of inquiry regarding extant criminal statutes that provide legal remedies for bad behavior. The right-of-center justice said he understood “the point” about state statutes and actually went on to clarify Sotomayor’s point further by asking for examples of federal criminal liability that could implicate Van Buren’s behavior without the use of CFAA. Kavanaugh also, however, expressed concerns about privacy interests of certain employees who might be impacted by tossing the statute–making his vote no sure thing for either side.
Liberal Justice Stephen Breyer appeared perplexed by the government’s argument and seemed to side with Van Buren’s understanding of the statute. While questioning Feigin, Breyer’s tone of voice suggested he was astonished by the government’s position that violating a website’s TOS was not covered by the CFAA.
Fisher, for his part, mostly argued that the CFAA portion at issue must be invalidated due to constitutional vagueness concerns.
“This is an impossible vagueness problem [that includes] literally any circumstance you can possibly imagine,” he told the court.
According to the petitioner, the statue itself “gives you no tools” to distinguish hypothetical prosecutions based on TOS violations from what the government says are more “troubling” violations. The essential point, Fisher argued, is that the text is far too ambiguous–it could go either way–and that when it comes to criminal laws, the courts should never trust prosecutors to be on their best behavior.
“My problem is that you are giving definitions that narrow the statute that the statute doesn’t have,” Sotomayor lectured Feigin at one point. “You’re asking us to write definitions,” she continued, “to limit a broad statute that is otherwise dangerously vague.”
Federal criminal defense attorney and computer law expert Tor Ekeland excoriated the CFAA’s vague language in an email to Law&Crime:
The failure of the CFAA to define one of its central prohibitions – prohibiting unauthorized access to a computer, or in the case of Van Buren, exceeding authorized access to a computer – is a gift to creative prosecutors and plaintiff’s lawyers because it allows them to transform routine computer use into a felony or expensive civil cause of action. If the Court rules against Van Buren, which I doubt, it will subject internet users to the whims of website owners when it comes to whether or not you are authorized to be on their site, whether those whims are expressed in a terms of service agreement or even after the fact. To rest the foundation of criminal and civil liability for computer intrusions and harms on subjective factors like a website owner’s terms of service or an employment contract brings with it a massive expansion of liability with no clear standards. It potentially makes you liable for your public search engine results if you come across something that a website owner didn’t mean to leave out in public but did. Should the Court rule against Van Buren I will be hiring a phalanx of CFAA lawyers to bring endless Plaintiffs suits and buy myself a private jet. But I doubt the Court will be so foolish.
That view appears likely to hold the day on this case.
Justice Elena Kagan also seemed largely unconvinced by the government’s position and said that Fisher “has a point” about the various ways the statute can be interpreted. Such a lack of clarity in a criminal law is typically fatal to a statute when it comes before the Supreme Court.
Justice Clarence Thomas and Chief Justice John Roberts did not seem to tip their hands either way during Monday’s oral argument though at one point, Roberts said he did not understand the government’s argument about what qualifies as “authorization” under the statute.
Even Justice Samuel Alito was at a loss on Monday. The typically punitive and pro-government justice credited both sides arguments but explicitly said he was confounded at finding a potential resolution to the thorny issues here.
“I find this a very difficult case to decide based on the briefs we have received,” Alito told Feigin at one point. While citing those aforementioned concerns about the impact on personal privacy for certain employees, he contrasted that issue with the government’s interpretation which, he said, “would criminalize all sorts of activity that people would find innocuous.”
Near the end of the proceedings, Gorsuch summed up the mood of the court on Monday–at least insofar as the justices’ questions and comments gave anything away–by calling the CFAA a “rather remarkable” law which could result in “perhaps making a federal criminal of us all.”
[image via screengrab/CBS News]
