A 6–3 ruling issued by the Supreme Court on Thursday that narrowed the scope of a 1986 federal cybercrime law resulted in a rather unusual pairing of justices.
The three jurists appointed by former President Donald Trump — Amy Coney Barrett, Neil Gorsuch, and Brett Kavanaugh — all sided with the court’s three most liberal justices to form the majority, Politico reported, while the more moderate Chief Justice John Roberts joined with Justices Samuel Alito and Clarence Thomas in dissents.
The case reportedly involved a former police officer named Nathan Van Buren. As part of an FBI sting operation, Van Buren had allegedly used his access to a state vehicle database to look up a license plate number in exchange for a bribe.
In addition to indisputably violating department policy, the former cop was charged and convicted for violating the 1986 Computer Fraud and Abuse Act (CFAA) for misusing the database that he was otherwise authorized to use.
A lesson in linguistics
It was Justice Barrett who wrote the majority opinion that ultimately reversed Van Buren’s conviction under that federal statute. Much of what she wrote read as though it were a treatise on linguistics as she dissected the definitions in question.
The statute imposed penalties on anyone who “intentionally accesses a computer without authorization or exceeds authorized access” — with the phrase “exceeds authorized access” being defined as, “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.”
For Barrett, everything came down to the meaning and use of the word “so” in the phrase “not entitled so to obtain.”
Ultimately, she came to the conclusion that while what Van Buren had done was improper, he had not exceeded his authorized access to the database, since he was indeed permitted to look up license plate information.
In reaching that conclusion, Barrett also pointed out the negative ramifications of the federal government’s broad interpretation of the law, saying that it “would attach criminal penalties to a breathtaking amount of commonplace computer activity,” and that if the statute truly did criminalize violations of computer-use policies, “then millions of otherwise law-abiding citizens are criminals.”
As examples, she pointed to workplace rules, noting “an employee who sends a personal e-mail or reads the news using her work computer has violated the CFAA.”
She also suggested the broad reading of the law “criminalize everything from embellishing an online-dating profile to using a pseudonym on Facebook,” and even “checking sports scores or paying bills at work.”
In the end, the majority determined that “an individual ‘exceeds authorized access’ when he accesses a computer with authorization but then obtains information located in particular areas of the computer — such as files, folders, or databases — that are off-limits to him.” That doesn’t apply to Van Buren, the justice said, since he had the authority to access the database in the first place.