The U.S. Supreme Court on Thursday in Van Buren v. United States found that a Georgia police officer did not breach federal computer fraud law by overstepping his authorized access to government records, raising concerns that the U.S. Department of Justice's reading of the statute could criminalize innocuous internet activity.
The justices (6-3) reversed the Eleventh Circuit's October 2019 decision to uphold ex-Georgia officer Nathan Van Buren's CFAA conviction under the Computer Fraud and Abuse Act, which came after he was accused of "exceeding" his authorized access to a law enforcement database after accepting $6,000 from an acquaintance who, while working with the FBI as part of a sting operation, told Van Buren he needed to know whether a woman he had met at a strip club was an undercover police officer before deciding whether to pursue her further, to look up whether someone was an undercover police officer. Van Buren then "exceeded" his access to the Georgia Crime Information Center by running a search for the woman's license plate to determine if she was, in fact, a police officer, prosecutors claimed. Previous coverage here.
"The government's interpretation of the 'exceeds authorized access' clause would attach criminal penalties to a breathtaking amount of commonplace computer activity," wrote Justice Amy Comey Barrett for the majority. Barrett was joined by Justices Stephen Breyer, Sonia Sotomayor, Elena Kagan, Neil Gorsuch and Brett Kavanaugh in the majority decision. Justice Clarence Thomas filed a dissent, joined by Justice Samuel Alito and Chief Justice John Roberts Jr.
The CFAA is considered the main federal anti-hacking law used by prosecutors when outside actors are accused of breaking into government or private computer networks. But the part of the law considered in Thursday's decision covers those who "access a computer with authorization and use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter."
The case is Van Buren v. United States, No. 19–783 (S. Ct. June 3, 2021).