The Supreme Court Is Being Asked To End Questionable CFAA Prosecutions

The Supreme Court is being asked to resolve a circuit split on the reach of the Computer Fraud and Abuse Act. The CFAA has done a lot of damage to security researchers and others who violate terms of service agreements. The "others" include everyday Americans who have no idea they might be violating federal law when they do things like give fake information to social media companies or use work computers for personal reasons.

The CFAA case SCOTUS is being asked to look at involves something a bit more serious than that. It deals with a police officer who took money to search a license plate database for someone who had no legal access to it. Here's a brief description of what triggered the prosecution from the Eleventh Circuit Appeals Court.

During the interview [with the FBI], Van Buren admitted he had concocted a fake story about his son's need for surgery to justify asking Albo for $15,000. He also conceded he had received a total of $6,000 from Albo. In addition, Van Buren confessed he had run a tag search for Albo and he knew doing so was "wrong." And while Van Buren asserted that $5,000 of the money he received from Albo was a "gift," he did reply "I mean he gave me $1,000" when asked if he received anything in exchange for running the tag. Finally, Van Buren conceded he understood the purpose of running the tag was to discover and reveal to Albo whether Carson was an undercover officer.

The Appeals Court tossed out the honest services fraud charge but left the CFAA conviction intact. The end result was a split with other circuits which have declared simply violating a site or system's terms of service cannot trigger criminal charges under the CFAA.

Here's why the case is important, as summarized by Orin Kerr for the Volokh Conspiracy:

The split is clear and acknowledged, and it's crazy important. The CFAA either makes most people or very few people criminals. Indeed, I have testified under oath that I am a criminal in the Eleventh Circuit. I violate Facebook's terms of service by giving a false location, which according to the DOJ and the Eleventh Circuit is a federal crime every time I visit Facebook. You probably ignore terms of service, too. So the stakes are pretty high. The stock line I have when I lecture about the CFAA is that no one can know what the statute means until the Supreme Court finally resolves the split. And I've been offering that line for years, as the split has lingered without being resolved.

This case has the potential to decriminalize acts that should never have been criminalized in the first place. The DOJ has stated it won't pursue prosecutions for mere terms of service violations and yet here's a case where it's doing exactly that. The underlying facts suggest something far more troubling than lying about your exact location when logging into a social media service, but it's the broad reading of the CFAA by the Eleventh Circuit that threatens to do a lot of damage to computer users around the nation. This is the reading the DOJ pursues in that jurisdiction and it will apparently continue to do so until told otherwise.

And it doesn't want to be told otherwise. The DOJ is asking the Supreme Court to take a pass on this case and allow it to pursue questionable CFAA prosecutions in any circuit where this remains unresolved. The DOJ may promise to use its prosecution powers with more discretion when its prosecutorial tactics are challenged in court (as in this case before the DC Appeals Court) but the facts of this case don't bear that out. It has been more than happy to abandon cases in other circuits where rulings have forbidden prosecutions for broad readings of unauthorized access. But in the circuits where it can still get away with it, it still pursues these prosecutions it tells other circuits it's not interested in pursuing.

No one wants to see a crooked cop cut loose because the government chose to pursue a prosecution under a badly-written law. But we don't want to see a bunch of people far less odious than this particular officer prosecuted by the DOJ for far more innocuous activities.