Hacker News Reader

> A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite.

No, this isn't what this means at all. This ruling just means you haven't committed a crime under the Computer Fraud and Abuse Act by accessing that data if you didn't "hack" to get access to it. Depending on the information you sold, you could've violated other laws and you definitely violated the Non-Disclosure agreement you signed with those companies.

For reference, the cop in this case had other convictions under wire fraud laws that weren't changed by this.

> To me, asking you not to look at certain information is effectively the same as putting a password on it, then having you break it.

To me, they are not effectively the same at all. I see there being two different types of "authorization" at play. One is a mechanical authorization built into the computer systems (a password, for example). The other is a policy authorization, built into how I convey to you what is "allowed" on the system. They seem fundamentally different to me.

To 6 justices on the Supreme Court, they are not effectively the same thing either. To 3 justices, they are. The ambiguity of English is definitely annoying when we get into the nitty-gritty of laws!

> A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite.

That's simply not what this ruling holds. That would be an accurate summary of this ruling if and only if the CFAA were the only law that exists in the United States Code!

"Legal" is also an ambiguous word in this context. Such an activity may break other laws, or it may not. I'm not familiar with what other criminal liability may attach to such behavior. But that activity almost certainly would be a civil violation. I would potentially be able to sue Google/Humana/Tinder (though there's a chance their privacy policy already gives them the option to sell my information). And Google/Humana/Tinder could certainly sue the rogue employee for damages caused by such a sale.

If Google/Humana/Tinder wanted to go further to protect themselves from bad-acting employees, they could use actual access controls (instead of mere policy) to restrict the ability for employees to access such data and only give access to employees who need such access. While it's certainly not the thing a Supreme Court ruling should hinge on, it's a nice added bonus that this gives a further incentive for companies to implement actual least access control rather than just making it a policy.

> If Google/Humana/Tinder wanted to go further to protect themselves from bad-acting employees, they could use actual access controls (instead of mere policy) to restrict the ability for employees to access such data and only give access to employees who need such access.

I'm pretty sure the exact fact that Amazon did not appropriate restrict access in this way is one of the points being considered in the antitrust case. Specifically, that people who shouldn't have been able to, and who shouldn't have by policy, still could access seller data.

>There have been separate rulings dealing with whether or not employees can use corporate equipment for personal reasons.

Such rulings are about different laws. The government's interpretation would criminalize violating a protected computer's terms-of-service regardless of whether it is part of a corporate intranet or an ordinary website on the Internet. And yes, the government has pursued criminals charges for violating a website's ToS; see United States v. Drew, 259 F.R.D. 449 (C.D. Cal. 2009).

>A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party. This ruling means that such activity is perfectly legal, even if the terms of their employment state the opposite.

As to Humana, it would likely be a criminal HIPAA violation.

> A more analogous example to the case at hand would be an employee at Google/Humana/Tinder selling your private details to a third party.

That's not a realistic example because something like that would be covered by an NDA or alternatively, if in EU or California, by data policies.