Hacker News Reader

That interpretation leads to such a massive broadening of felony criminal liability. It doesn't gut-check for me

I agree with you, it totally fails the gut check, but it is because the law is poorly written. The Supreme Court bailed out the lawmakers by winging it here. The minority opinion is the worse, but more accurate plain reading of the law.

Well, that ignores the part where I agree with the textual reading and interpretation of the majority.

I think the majority opinion is also the more accurate plain reading of the law. So, from my perspective, no bailing out is necessary. The gut check and the plain reading both seem to align.

intentionally accesses a computer without authorization or exceeds authorized access

Did he exceed authorized access? He did, and therefore he broke the plain reading of the law. The law should be better, and separate violating access controls from violation of access policy, but it doesn't.

> Did he exceed authorized access?

He did not. He was given a level of authorization that he did not exceed.

The problem, again, is in the ambiguity of the word “authorized” that allows multiple plain readings.

To me, it’s absolutely plain that “authorized access” refers to system authorization (that is, what the computer tells the user their permissions are), and “exceeds authorized access” refers to bypassing the system authorization limits. That’s absolutely the plain reading to me.

To you, you read “authorization” as “policy authorization” (that is, where another human tells you what your permission levels are).

The fact is, there are multiple kinds of “authorization” involved in this case, which means different people can have different plain readings of the statute. While your reading seems obvious to you, it seems strained to me. My reading might be strained to you, but it’s obvious to me.

Since they didn't specify what type of authorization, the plain reading is that it covers all types.

> the plain reading is…

No, that’s not quite right.

*To you* the plain reading is what you say. To *other* people the plain reading is different.

I, for example, don’t think the plain reading of something typically involves taking the union of definitions for each word in the sentence. To me, most plain readings involve selecting the single most appropriate definition for a word based on the surrounding context.

My point is that there isn’t an objectively correct “plain reading”. You are not the arbiter of what a plain reading is, nor am I.

Would you agree that different people can read the same sentence and in good faith have a different understanding of what “the plain reading” is?

The alternative would be declaring the act void for vagueness. A statute that "forbids or requires something in terms so vague that men of common intelligence must necessarily guess at its meaning and differ as to its application" violates the constitutional provision of due process. So the SCOTUS ruling makes sense in terms of choosing the least disruptive option wrt. general expectations.

Not really. I would just read the word "fraud" in the very title of the act and decide that means that whether or not the access was unauthorized depends on whether you lied to gain access.

I won't claim that test is perfect, but it's a lot clearer than the current standards and when I go through past cases, I don't see it coming to any indefensible conclusions.

Yes, that would agree with the majority holding in this case. It's important to note that even if they didn't violate the CFAA, they likely broke plenty of other laws and can be punished for that.

So this conduct absolutely deserves to be punished, just not under the CFAA.

For the requisite car analogy: one is like a mechanic taking your car for a joyride after you give them the key, the other is a stranger taking it for a joyride after breaking in and stealing it out of your driveway.

One of them is misusing a car that you gave them access to, the other one is stealing it.

In my jurisdiction, a mechanic who takes a car for a joyride is committing a class A misdemeanor (unauthorized use of a vehicle in the third degree)

ref. https://codes.findlaw.com/ny/penal-law/pen-sect-165-05.html

In other jurisdictions (like, say, New Hampshire), that same case falls into the definition of theft.

http://www.gencourt.state.nh.us/rsa/html/LXII/637/637-9.htm

That's because you're assuming the stranger doesn't return the car. If your mechanic takes your car for a joyride after you give them the key for purposes of repairing your car, and a stranger steals my car when I'm not using it and brings it back before I notice it's missing, I don't understand why one is any different or worse than the other.

> but then ask you not to look in the `Taxes` folder on the desktop should it be a felony for you to open the `Taxes` folder? That conceptually feels wrong to me. I have violated your trust, sure, but I haven't committed fraud

You accessed privileged information that you were explicitly not allowed. To me, asking you not to look at certain information is effectively the same as putting a password on it, then having you break it. In both cases, the intent of the owner is clear: do not access these files. And in both cases, the actions of the perpetrator very clearly disregard the owners intent.

Your example about accessing a website is not the same. It's pretty clear that the person going to new.ycombinator.com is not stealing or accessing privileged information. There have been separate rulings dealing with whether or not employees can use corporate equipment for personal reasons.

A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite.

Unless, of course, the only reason the court ruled in favor of this person was that they are a police officer. But I guess we have to wait until the FBI attempts to press charges against someone at Google selling personal details to third parties to find out.

> A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite.

No, this isn't what this means at all. This ruling just means you haven't committed a crime under the Computer Fraud and Abuse Act by accessing that data if you didn't "hack" to get access to it. Depending on the information you sold, you could've violated other laws and you definitely violated the Non-Disclosure agreement you signed with those companies.

For reference, the cop in this case had other convictions under wire fraud laws that weren't changed by this.

>There have been separate rulings dealing with whether or not employees can use corporate equipment for personal reasons.

Such rulings are about different laws. The government's interpretation would criminalize violating a protected computer's terms-of-service regardless of whether it is part of a corporate intranet or an ordinary website on the Internet. And yes, the government has pursued criminals charges for violating a website's ToS; see United States v. Drew, 259 F.R.D. 449 (C.D. Cal. 2009).

>A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite.

As to Humana, it would likely be a criminal HIPAA violation.

> To me, asking you not to look at certain information is effectively the same as putting a password on it, then having you break it.

To me, they are not effectively the same at all. I see there being two different types of "authorization" at play. One is a mechanical authorization built into the computer systems (a password, for example). The other is a policy authorization, built into how I convey to you what is "allowed" on the system. They seem fundamentally different to me.

To 6 justices on the Supreme Court, they are not effectively the same thing either. To 3 justices, they are. The ambiguity of English is definitely annoying when we get into the nitty-gritty of laws!

> A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite.

That's simply not what this ruling holds. That would be an accurate summary of this ruling if and only if the CFAA were the only law that exists in the United States Code!

"Legal" is also an ambiguous word in this context. Such an activity may break other laws, or it may not. I'm not familiar with what other criminal liability may attach to such behavior. But that activity almost certainly would be a civil violation. I would potentially be able to sue Google/Humana/Tinder (though there's a chance their privacy policy already gives them the option to sell my information). And Google/Humana/Tinder could certainly sue the rogue employee for damages caused by such a sale.

If Google/Humana/Tinder wanted to go further to protect themselves from bad-acting employees, they could use actual access controls (instead of mere policy) to restrict the ability for employees to access such data and only give access to employees who need such access. While it's certainly not the thing a Supreme Court ruling should hinge on, it's a nice added bonus that this gives a further incentive for companies to implement actual least access control rather than just making it a policy.

> If Google/Humana/Tinder wanted to go further to protect themselves from bad-acting employees, they could use actual access controls (instead of mere policy) to restrict the ability for employees to access such data and only give access to employees who need such access.

I'm pretty sure the exact fact that Amazon did not appropriate restrict access in this way is one of the points being considered in the antitrust case. Specifically, that people who shouldn't have been able to, and who shouldn't have by policy, still could access seller data.

> A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party.

That's not a realistic example because something like that would be covered by an NDA or alternatively, if in EU or California, by data policies.

Judges interpret ambiguous laws narrowly to avoid criminal liability, as you say.[1] Three justices dissented though, I take it, because in their view the words weren't ambiguous, even if leniency would have been the better public policy.

[1] https://en.m.wikipedia.org/wiki/Rule_of_lenity

I initially agreed with Justice Thomas's viewpoint but you really make it clear that he is wrong.