Supreme Court mulls whether a cop looking up a license plate for cash is equivalent to watching Instagram at work
- Reference: 1606824969
- News link: https://www.theregister.co.uk/2020/12/01/cffa_supreme_court/
- Source link:
Nowhere is that more clear than in a case [1]heard in the US Supreme Court on Monday , covering a cop – former police sergeant Nathan Van Buren – who was convicted of breaking the Computer Fraud and Abuse Act in 2017 after using his access to a police database of license plate numbers to look up the owner of a specific car for a cash payment.
Van Buren challenged that conviction, and an appeals court overturned one of the two criminal charges against him (it ordered a new trial) but upheld the second – computer fraud – despite what it said was the “vague language of the CFAA.”
And it is that “vague language” that has led the case [2]all the way up the Supremes , with the court choosing to hear “whether a person who is authorized to access information on a computer for certain purposes violates Section 1030(a)(2) of the Computer Fraud and Abuse Act if he accesses the same information for an improper purpose.”
Van Buren’s lawyer, Jeffrey Fisher, argued that once someone is authorized to access a database, such a cop authorized to use a plate database, that’s pretty much it – you can’t be found guilty of fraud under the CFAA. The law, he argued, was intended only to address hacking – and his client didn’t hack the computer.
Trade secrets
He also pointed out that there are plenty of other laws that can be used against someone who does something wrong with information they have access to: anti-stalking laws, for example. Or misuse of trade secrets. But seemingly nothing that would get a cop convicted for looking up people's license plate numbers for cash.
Fisher was particularly keen to argue the danger of interpreting the CFAA in the way the government had in this case. It opens up a Pandora’s Box of legal nasties, he warned: suddenly anyone and pretty much everyone would be guilty of criminal conduct.
CFAA latest: Supremes to tackle old chestnut of what 'authorized use' of a computer really means in America [3]PREVIOUS REPORT
If you broke a service contract, or a company’s terms of use, or an employee handbook, or even if you ignored a verbal instruction and used your authorized access to a computer at the wrong time, you could be convicted, he argued.
He even argued that accessing Instagram at work would fallen under the criminal statute. “It's obtaining information because you are literally obtaining the words or pictures out of Instagram, and it would violate the government's rule,” he argued in response to questions from the Justices.
Fortunately, the Supreme Court was not in the mood for super-hypothetical nightmare situations of Janice from accounting being dragged off to the cells for looking at someone’s cat pictures. At least four Justices referred to Fisher’s list of problems as a “parade of horribles,” while digging into the reality.
And the reality is that the CFAA is – as everybody knew already – really badly worded. The law was originally passed in 1984 to deal with wrongly accessing computer databases but it originally only applied to federal employees. In 1986, the law was expanded to include everybody and in doing so a few key phrases were changed. The idea was the same but the language of the law became less precise.
Of course the government’s lawyer, DoJ deputy solicitor general Eric Feigin, feels that the law is absolutely fine: the intention of the law is clear, the wording can be read in a specific way that avoids all the nightmare scenarios and the legal system will clear it up through case law. Nothing to see here. The cop knew he was wrong, he got caught, and was prosecuted.
Avalanche
“Such serious breaches of trust by insiders are precisely what the statutory language is designed to cover,” Feigin argued. He also had some harsh words for Van Buren’s case.
“What he's instead relying on here is a wild caricature of our position that tries to bury his own heartland statutory violations beneath an imaginary avalanche of hypothetical prosecutions that he can't actually identify in the real world for seemingly innocent conduct,” he barked.
But then Feigin also demonstrated his ignorance of how computers work in the real world. Asked why accessing a service like Facebook wasn’t also included under the CFAA, he argued: “On the public website, that is not a system that requires authorization. It's not one that uses required credentials that reflect some specific individualized consideration.”
Such serious breaches of trust by insiders are precisely what the statutory language is designed to cover
Except of course, it does. Especially if someone is using two-factor authentication for additional security.
In response to the “don’t worry about it, we’ve won’t go overboard” argument from the government, the cop’s lawyer warned, not unreasonably, that “because this is a criminal case, we think it's improper if not, at the very least, very dangerous to rely on legislative history to resolve ambiguity.”
And he argued that “the opportunities for prosecutorial discretion are probably broader than any statute the Court has ever seen if the government is right in literal terms.” In other words, this law could end up being used to come down on someone and exert massive pressure for the wrong reasons.
That is not a hypothetical because it’s exactly what happened to Aaron Swartz, who was prosecuted for downloading millions of research papers. He was aggressively pursued under the CFAA, and told he could face a million-dollar fine and up to 35 years in prison for his actions.
Unable to deal with the pressure, Swartz [4]killed himself . And the tech community recoiled in horror at what the government was willing to do when it felt there was wrongdoing.
Legislative failure
Swartz’s case led to repeat efforts to tidy up the CFAA to make it clear that terms of service were specifically excluded from the law. But thanks to both Congress’ dysfunction, and the general lack of interest in and knowledge of technical and computer issues among lawmakers, the efforts have never made sufficient progress.
In that respect, the case in front of the Supreme Court today was completely avoidable: it should have been resolved through the legislative process five years ago. And in fact Van Buren’s lawyer repeatedly argued that the issue – the dangerous ambiguity – was something that Congress had to sort out by amending the statute.
Surprise! Voting app maker roasted by computer boffins for poor security now begs US courts to limit flaw finding [5]READ MORE
However, that’s currently not the case and the Supreme Court has to decide what to do with a law that was designed for one purpose, squeezed to fit another, and is now being applied to a third that was never envisioned.
The solution is not even that difficult: the law needs to recognize the difference between someone given access to privileged data through a specific, individual login and a simple login to a publicly available service. And it needs to make clear that misuse of that information is the crime.
The Justices kept putting forward suggestions. Justice Sotomayor noted that using information “for financial gain” was a common differentiator; Justice Barrett referenced the idea of a “scope” of authorization.
In fact, everyone in the courthouse – well, on the Supreme Court Zoom channel – was pretty much in agreement: the CFAA has a clear purpose that everyone agrees with but its wording is creating a major legal headache.
Like we said, computer law from the 1980s is a mess. ®
Get our [6]Tech Resources
[1] https://www.supremecourt.gov/oral_arguments/audio/2020/19-783
[2] https://www.theregister.com/2020/04/20/supreme_court_cfaa/
[3] https://www.theregister.com/2020/04/20/supreme_court_cfaa/
[4] https://www.theregister.com/2013/01/13/anger_death_aaron_swartz/
[5] https://www.theregister.com/2020/09/04/voatz_supreme_court/
[6] https://whitepapers.theregister.com/
Re: " led the case all the way up the Supremes"
Yep, all the way up the ladder to the roof...
> we think it's improper if not, at the very least, very dangerous to rely on legislative history to resolve ambiguity
So a lawyer who doesn't believe in precedent? I wonder which other parts of the law he doesn't believe in?
There's believing in precedence and there's allowing judges' interpretations of badly worded laws to fix issues (particularly ANYTHING related to technology). Putting bad laws in place and assuming the courts will fix it later is lazy and liable to abuse from both prosecutors and defences.
Declaring ‘things must/must not happen – let the courts find some such things later’ is not a reasonable legislative approach. This is exactly the statement expressed by the lawyer.
No, "legislative history" means what the lawmakers in Congress said about the law, what it meant and why they passed it. "Precedent" is what judges decided about it since then, which is completely different.
I'd think there's a big difference between resolving an ambiguity in law by referring to what legislators intended to enact, and resolving an ambiguity in what legislators intended by somehow inferring what they might have intended under some alternate technological progress timeline. The first can often be pinned down firmly. The second is just an attempt to create law without any kind of scrutiny.
Supreme Court
Isn't that exactly what the US Supreme Court does? It interprets the constitution of the USA to decide what current US laws mean. The fact that the US constitution is hundreds of years old and was written by slave-owning rich white men is irrelevant.
Ignorance or lack of it
On the subject of accessing Facebook to quote "Except of course, it does. Especially if someone is using two-factor authentication for additional security."
Unless things have changed radically, you don't actually have to log in to access Facebook.
You do to post, etc, but whilst you might be nagged to log in to view content it isn't actually needed.
So maybe not so ignorant after all
Re: Ignorance or lack of it
Not to mention Facebook, Google, Amazon etc. are using UNAUTHORIZED access to track you across the web. Of course, if this law changes all the MegaCorps. will have it re-written so there's never a doubt that you can be spied on. When it's re-written, MegaCorps will be allowed to log INTO YOU and "gather data for economic growth" . Too paranoid... look around, what world do you live in?
I went and read the law and I like it. It works for people and company, as seen with most computer laws before IT influence (a.k.a. greed). Stupidity is no excuse, why do people make it so? If you're an IRS tax agent, you can't look up the tax history of Netflix to pay your bill!! The cop is guilty by just about every case, read this link... https://www.law.cornell.edu/uscode/text/18/1030#
(1) having knowingly accessed a computer without authorization or exceeding authorized access,
(2) intentionally accesses a computer without authorization or exceeds authorized access,
(3) intentionally, without authorization to access any nonpublic computer of a department or agency of the United States,
(4) ... It just goes and on... guilty.
Why case law?
Case law always puzzled me as a concept. Wouldn't it be better to revise the law instead?
Case law (Vast oversimplification I'm sure!):
1. Create a new law
2. Lawyers now need to learn the new law.
3. Prosecute someone under that law, and notice some issue or ambiguity in the law. i.e. It's not been written well and is too open to interpretation, or the Worlds moved on, and things not envisioned at the time of writing, are now possible etc etc.
4. Escalate this issue to some higher ranking judges, for them to interpret the law, make a decision.
5. Create new case law based on the decision.
6. Lawyers etc now need to learn the new case law, in addition to the original law.
Move on a few years, and you potentially have many case laws for the original law, and a whole mess to sort out by lawyers and judges.
Alternate:
1. Create a new law
2. Lawyers now need to learn the new law.
3. Prosecute someone under that law, and notice some issue or ambiguity in the law. i.e. It's not been written well and is too open to interpretation, or the Worlds moved on, and things not envisioned at the time of writing, are now possible etc etc.
4. Escalate this issue to some higher ranking judges, for them to interpret the law, make a decision.
5. DIFF STARTS HERE: Update the original law based on the decision. i.e. we now have Law 'x' version 1.1
6. Lawyers etc now need to learn the updated law.
Move on a few years, and you still only have the one law to learn, you just need to keep pace with the revisions.
This would also allow changes to the law, where it no longer makes sense, for example if something was specific to a tech that no one uses any more.
Just a thought anyway!
Re: Why case law?
Certainly there are many things outside of software that would benefit from change control. Lets put all the laws in Git....
Re: Why case law?
While this is nice in theory, the turnaround for modifications to a law can be measured in decades. For a computer analogy, think of parliament writing the spec and the legal system doing the user acceptance testing and bug fixing.
Re: Why case law?
Decades? Hardly. It can sometimes be measured in days or weeks, and is frequently measured in months.
It can also be measured in miles. There are MANY cases where a US federal law means five different things depending on what part of the country you're in, and unless the SCOTUS deigns to fix it another court can still find a sixth.
Re: Why case law?
Interesting isn't it. There is now law in practice just rules mangled by prior decisions. A case is something brought out of thin air and proved in tenuous ways. Lame.
Re: Why case law?
"There is now law in practice just rules mangled by prior decisions."
Indeed there is. It's called "common law", and dates back to the 1100s if I remember right.
Re: Why case law?
The 'Alternate' scenario here is kinda what happens because new texts get written which summarise case law and lawyers only need to read that for the most part, referring to the specific cases occasionally for further clarification.
It's not like you go to law school and they show you a humongous library and say "Right, start at 1066. I hope you're a fast reader".
Re: Why case law?
You need to remember that most lawmakers are lawyers. It’s a job creation process. They want the original language to be vague to catch as many cases as they can, and having to trawl through case law creates more work for their brethren.
Re: Why case law?
It's what is attempted in country not based on common law. The legislators attempts to identify all the possible situations, thereby the law is usually very complex. Usually they fail, and with time, more previously unknown situations piles up. So more and more loopholes are found. Instead of enacting a full new law, articles are continuously modified. Sometimes they are so extensive they make a different law, and tacking all the changes becomes a true pain anyway. Lawyers could have the required tools, "common people" less so.
Legislators should stop aiming at grandstanding and need to return to be humble people writing needed laws.
So simple ...
"And it needs to make clear that misuse of that information is the crime."
As I understand it, that is one of the arguments againt the statute as it potentially means that anyone who signs or accepts a licence agreement would be liable to criminal prosecution not civil liability.
Of course this means the 'simple' wording needs 'simply' extending to exclude private data ... but that would only refer to personal private data on a private machine not data hosted or belonging to a third party organisation ... unless of course you accepted a licence to access a private organisation's systems to look at data ... for instance a cloud database which happens to contain your personal data as part of a bigger system ... Oops it's suddenly complicated. I can see an email on the webmail server that says Malcom was sleeping with Justin's hamster - my data (addressed to me) but if I mention it to anyone am I dragged into the courts by Justin's jealous dog because that data was not on a personal, private system but held on a corporate email server that I was granted access to and which now makes it a criminal offence to 'use' under the CFAA ...
The CFAA is clearly rubbish and needs fully rewriting ... carefully.
nothing that would get a cop convicted for looking up people's license plate numbers for cash
There's the problem right there. Isn't there any concept of "corruption"?
Or is that a can of worms that nobody is brave enough to touch?
Re: nothing that would get a cop convicted for looking up people's license plate numbers for cash
The article here doesn't mention this, but the cop was also convicted of "honest services fraud", which covers that angle.
Background information
The Electronic Privacy Information Center (EPIC) has more information here: https://epic.org/amicus/cfaa/van-buren/
Quote -------------------------
The FBI charged Van Buren with honest-services fraud and felony computer fraud. A jury convicted him on both counts. On appeal to the Eleventh Circuit, Van Buren argued, among other things, that the jury instructions were incorrect and that there was insufficient evidence to support his convictions. The Eleventh Circuit reversed and remanded the honest-services conviction because of an error in the jury instructions, but affirmed the computer-fraud conviction. The court determined that it was bound by its prior ruling in United States v. Rodriquez, where the court held that a Social Security Administration employee who accessed the personal information of seventeen individuals in an agency database for personal reasons “exceed[ed] authorized access” under the CFAA.
Van Buren petitioned for review in the U.S. Supreme Court, arguing that the Eleventh Circuit’s decision deepens a circuit split over the interpretation of “exceeds authorized access.” The Court granted review on the question
Whether a person who is authorized to access information on a computer for certain purposes violates Section 1030(a)(2) of the Computer Fraud and Abuse Act if he accesses the same information for an improper purpose.
End quote --------------------
Note that he was also convicted of "honest services fraud". The "reversed and remanded" means that it got sent back to the original court for a retrial. That retrial will probably also result in a conviction.
How about Bribery?
It seems that this would have been better handled as using one's privileged position for monetary.
Bribery refers to the offering, giving, soliciting, or receiving of any item of value as a means of influencing the actions of an individual holding a public or legal duty.
So, cash offered, actions taken on the part of a person holding a legal duty, information transmitted, cash received.
Looks like they picked the wrong law to enforce.
Reference: https://www.law.cornell.edu/wex/bribery#:~:text=Bribery%20refers%20to%20the%20offering,a%20public%20or%20legal%20duty.&text=Solicitation%20of%20a%20bribe%20also,receipt%20of%20a%20valuable%20gift.
No laws?
"But seemingly nothing that would get a cop convicted for looking up people's license plate numbers for cash."
What about bribery, misuse of authority in public office, gross misconduct, data protection?
Set aside computers entirely. Does the law really say it is acceptable to pay a policeman to do things for you which are only possible due to a police officer's privileged position? Where those services take place in police time, in police offices, and using police resources?
Could you equally pay a council worker or tax officer to give you photocopies of documents they hold about your neighbour?
Most common misuse of Police Computers
Is, I believe, looking up the daughter's new boyfriend.
" led the case all the way up the Supremes"
Yes, they do seem to making quite a song and dance about it.