Hacker News Reader

I think there's a solid online analogy for HIPAA data.

Certain employees at a hospital have authorization to pull up medical records as part of their jobs. It is extremely illegal for them to view records that aren't required for specific work purposes. If a nurse is treating Jane Smith in room 203, it's OK and normal for her to look at Jane Smith's records. It's absolutely not OK, and punishable with huge fines, for her to pull up her ex-boyfriend's records just out of curiosity.

However, it's not a violation of the CFAA for her to look at her ex's data. It's 100% against HIPAA, but she didn't have to break into a computer system to view them. She was authorized to access the system. She wasn't authorized (by virtue of her work requirements) to pull up those specific, but as a nurse, the system permitted her to without going around any login prompts or doing anything harder than typing "John Doe" into the search box.

That's the distinction that the CFAA cares about. It's about breaking into systems, or, at least, that's why it was written and that's how the SCOTUS just ruled that it was meant for. It's about access to the system in general, not access to a specific record in the system. There are other laws that govern those specifics.

So the actual crimes are far better enforced by more accurate legislation. Not swept up by an overly broad, and borderlom irrational interpretation of the CFAA.

For ex: the accused is still authorized to access the computer. A cashier at a grocery store is authorized to open/close the til all day long.

These may present opportunities but shouldn't be the focus of any crime. The theft itself is already firmly in the criminal code as being illegal.

The fact it was computers doesn't change things.

Nailed it.

It seems to me like the issue here is that reasonable people disagree on where the boundary between work misconduct and criminal liability is, and that computers being involved are pushing that to the forefront in these kinds of cases.

Also there is no reason that misconduct of this kind couldn’t be prosecuted under laws preventing similar breaches that aren’t digital in nature.

Selling private data for bribes should be illegal whether or not it’s a database or a file cabinet.

I agree that defining where the boundary should be is tricky in practice, and it's a good point that this was hardly a unanimous decision, not to mention overruling the appealed ruling.

On the other hand, the underlying law, the CFAA, is about more than just workplace issues like this issue. Interpreting it broadly could mean that violating some terms of use could be a criminal offense, and I am glad that the court avoided that interpretation. It's better having this law be more specific to the intent of criminalizing "hacking" and leaving other laws or policies to deal with how one might abuse computers or networks that one is otherwise entitled to access.

>But he's not guilty of breaking and entering

He is in my state:

>A person commits the offense of criminal trespass when he or she knowingly and without authority:

>(1) Enters upon the land or premises of another person or into any part of any vehicle, railroad car, aircraft, or watercraft of another person for an unlawful purpose;

> A person commits the offense of criminal trespass when he or she knowingly and without authority

Note emphasis.

Going in my house without my permission (without authority) to do something illegal is criminal trespass, based on what you quoted. If you have permission to be in my house and do something illegal while in my house then that is not criminal trespass, based on what you quoted. Whatever illegal thing you did is still illegal, but you weren't trespassing.

Exactly the same as what GP and the parent of that said about CFAA. The CFAA, as the Supreme Court clarified with this ruling, makes it illegal to break into a computer system. But if you have permission to be in a computer system and do something illegal with that access, whatever you did is still illegal, but you didn't break into the computer system so you didn't violate the CFAA. Making it an exact digital equivalent of your trespassing law.

It can reasonably argued (and has been argued iirc) that you are not authorized to enter the room if not on official business.

>If you have permission to be in my house and do something illegal

Sure, but having permission to come in for a certain reason doesn't also grant you permission to come back lather for another reason. To use the analogy, the defendant had permission to enter the "house" for certain purposes. They subsequently entered it for an explicitly unauthorized purpose. That latter entry is trespassing.

I would be keen on seeing caselaw on this. Got any references I can read?

If you read the opinions, the dissent reads the CFAA as if it were just importing common law property-based rules to the electronic realm. As it applies to property, authorization is absolutely contextual. If I give a key to a housecleaner and they use it one afternoon intending to steal something, that's trespass. If they just happen to steal something on the spur of the moment, that's not trespass. However, the CFAA has additional language ("exceeds authorized access") that would capture such behavior. As the dissent notes, you can absolutely be charged with criminal trespass if you, for example, enter a National Park to remove a grain of sand in violation of park rules; it's the intent to do something in violation of the terms of access that makes it trespass.

The majority opinion says that applying common law property-based meanings is not the right approach. Rather, the CFAA makes far more sense if you understand authorization and similar terms in the sense they're more often used in computer science, which turn on the design of the authentication and authorization system itself, and are agnostic to external policy, agent intent, etc.

Yeah, I don't buy this line of argumentation. Suppose the locked room is an apartment and the person with a key is your landlord. I'm pretty sure he's not authorized to enter and do whatever.

A plain reading of "authorized" means "having official permission or approval." Van Buren might have been "authorized" to access the system but he certainly wasn't "authorized" to access certain data for cash bribes.

I guess I'm at a loss to see this as a "win" for civil liberties, but maybe I'm missing something.

You're trying to make the same argument as in the dissent, but the Court decision spent something like parts of 5 pages defining the word "so" and how this specific law applies to this kind of situation.

It's a win for civil liberties because how an employer writes their policies should not potentially open an individual up to federal criminal prosecution under the CFAA specifically.

So, what about the Michael Thomas case? Does this verdict overturn his conviction?

http://www.epspros.com/news-resources/news/2018/it-worker-lo...

"Mr. Thomas challenged the verdict, arguing that his conduct was not illegal because his IT position provided him full access to the system and empowered him to 'damage' the system by deleting files or taking the system offline. Thus, any acts were not 'without authorization.' The Fifth Circuit rejected this argument, finding that the statute’s prohibition against exceeding authorized access applies to insiders who go beyond the permission granted them in order to cause damage."

He'd presumably be guilty of other things but those might well be civil. IANAL. But when laws/interpretations change, they're not necessarily retroactive.

I was initially going to say no, that when he went on to damage files, he caused material harm. He was not authorized to "damage" the system, and although he had access to the system and so gaining access in and of itself is not a crime, causing damage would be.

But then I looked into the case a bit closer and I start to think he has an argument for not being charged under the CFAA. As with many laws, intent matters, so it is possible that if his intent was to harm the business, there may well be charges that could be applied in that realm. And obviously he could be held civilly liable for damages, which is no different than any other employee who does something to damage their employer's equipment. Offline example - if I work at a construction company, and I wreck construction equipment because I wasn't happy my co-worker got fired, that isn't going to be a criminal offense, but the company will likely fire me and try to collect damages.

So I'm going to go back on my initial judgement and say that I think he may have grounds to get his conviction overturned and while he may be charged with other crimes, not sure it would come from the CFAA.

*disclaimer, not a lawyer

If the CFAA doesn't apply to sys admins working at the highest levels of authorization, it seems to be a useless law. Foreign actors can simply hire sys admins to access whatever they want, no need for hacking.

I really do think the court has opened Pandora's box on this one. They should've voided the statute for vagueness if that was the concern. As it stands now, it has to be one of the dumbest laws on the books.

> Foreign actors can simply hire sys admins to access whatever they want, no need for hacking

This is prosecutable under a myriad of existing laws. CFAA was specifically crafted to deter and punish hacking. As far as I know, that's still very much a thing.

It's not immediately clear which laws. The whole point of the CFAA was that existing trespass & theft laws don't really work for digital files.

> not immediately clear which laws

Yes it is, theft of trade secrets [1].

[1] https://www.justice.gov/opa/pr/former-dow-research-scientist...

Espionage is illegal.

Companies have a responsibility to vet their employees, first. I don't know how that is affected by the CFAA being a bit more constrained than it was before, which was extremely overly broad.

I strongly disagree with your assessment (re: Pandora's box, dumbness), but I do think and acknowledge it is a law worthy of being replaced with one more up to date and more clear.

It prevents you from using someone else's credentials to access the system.

It prevents a whole bunch of other sophisticated attacks as well, but let's be honest, people just giving out their password or using a really weak password is the most likely scenario.

> If the CFAA doesn't apply to sys admins working at the highest levels of authorization, it seems to be a useless law. Foreign actors can simply hire sys admins to access whatever they want, no need for hacking.

It's still illegal to steal IP. But no, you can't charge a janitor with keys to the whole building for breaking and entering if he uses those keys to steal something.

You charge him for theft.

Private corporations are not legislatures. If you are an invited guest to my house and I say it's not ok to drink wine out of a shot glass, and instead you must always drink from a wine glass when in my house, and you do it, that's not a felony. If the family album is on the couch and I give it to you and say you can look at it, but don't look at the last two pages which have the pictures of the wife nude and you do that, that's not a felony.

You could, in both cases, theoretically argue that it's a trespass to chattels and get nominal damages, but that's a civil matter.

"Yeah, I don't buy this line of argumentation. Suppose the locked room is an apartment and the person with a key is your landlord"

So he would not be Breaking and Entering, and if he has a valid reason such as emergency it would be legal.

There are different crimes with different punishments and it's important the right ones are applied.

Fraud and theft are different. Manslaughter and murder are different. Sexual harrasment and rape are different.

"If a landlord does not give notice to the tenants or enters for an unauthorized purpose, the landlord may be charged with trespassing" [1].

[1] https://www.criminaldefenselawyer.com/resources/can-you-tres...

Which is different than breaking and entering

Yes, sure. But the point is that, under certain circumstances, the use of the key can exceed your level of authorization. Possession of the key isn't a get out of jail free card.

The point seems to be that using the key isn’t the crime.