Live data from Hacker News

Van Buren is a victory against overbroad interpretations of the CFAA

eff.org

61–70 of 99 posts

Re: Van Buren is a victory against overbroad interpretations of the CFAA

#61

This ruling is really confusing for me. So I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. Yet so many people I usually agree with (SCOTUS judges, EFF, privacy lawyers) are all calling this a win. Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liabl…

> So I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment.

After reading the background info in the Supreme Court decision PFD... Agreeing to accept a $5000 cash bribe from some sketchy dude for information available only to law enforcement, undoubtedly falls within many existing anti-corruption laws that he could have been prosecuted under.

Re: Van Buren is a victory against overbroad interpretations of the CFAA

#62

This ruling is really confusing for me. So I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. Yet so many people I usually agree with (SCOTUS judges, EFF, privacy lawyers) are all calling this a win. Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liabl…

The opinion doesn't mean they can't be held criminally liable for anything they do with access to that system, just that the CFAA isn't the law that is broken. That means that the punishment or restitution imposed, if any, has to do with some other harm that was caused, over and above the mere fact of, for example, your "intrusion" into Facebook's computers by posting a photo of a cartoon character and thus violating Facebook's terms of service.

In your gay-hookup-website example, you might be civilly or criminally liable in various states of the US under a variety of laws that have nothing to do with computers. For example:

· an invasion-of-privacy tort or negligent-infliction-of-emotional-distress tort due to publicly disclosing private facts about the plaintiffs;

· a breach-of-contract tort or tortious-interference tort or negligence due to damaging your employer's business relations with the users (especially if you signed an NDA);

· a misappropriation-of-trade-secrets tort arguing that the users' information is a "trade secret" of the employer;

· a breach-of-fiduciary-duty tort claiming that if someone was going to get paid for the users' information it should have been your employer and not you;

· a breach-of-confidence tort claiming that your employer owed the users a duty of confidentiality, and you correspondingly owed it to your employer, and that you breached it by selling the data to journalists; or

· a conversion tort because you used the computer system in a way you were not authorized to use it.

(Also, the employer can probably recover whatever you were paid with an unjust-enrichment tort.)

Aside from being a tort, trade-secret theft is also a federal crime, so if your employer can persuade a prosecutor to go after you, they may be able to get you jail time. IANAL but I think the trade-secret case here is kind of weak, because in your scenario I think the journalist isn't running a competing gay-hookup website, so they aren't competing with your employer. There's also a crime of "criminal conversion", which I think is also kind of a stretch, since the employer can still use the computer system.

However, there was a civil conversion award for conversion of computer programs in Alabama in 01978, and another for conversion of personal information in New York in 02007: https://www.law.cornell.edu/nyctap/I07_0029.htm and in Oregon in 02013: https://www.tradesecretslaw.com/wp-content/uploads/sites/232.... Such innovations are still controversial and not widely accepted: https://www.nortonrosefulbright.com/-/media/files/nrf/nrfweb...)

Re: Van Buren is a victory against overbroad interpretations of the CFAA

#63

This ruling is really confusing for me. So I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment. Yet so many people I usually agree with (SCOTUS judges, EFF, privacy lawyers) are all calling this a win. Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liabl…

Perhaps it would be helpful to consider an offline analogy. Suppose there were no computers involved and all the information was stored in files in a locked room. Now Van Buren is given a key to access the filing room for his duties, and then uses his key to go in and look up the file on some license plate in exchange for money. Clearly, this is a terrible breach of trust and authority. It should be against policy. H…

>But he's not guilty of breaking and entering

He is in my state:

>A person commits the offense of criminal trespass when he or she knowingly and without authority:

>(1) Enters upon the land or premises of another person or into any part of any vehicle, railroad car, aircraft, or watercraft of another person for an unlawful purpose;

Re: Van Buren is a victory against overbroad interpretations of the CFAA

#64

Earlier quoted context omitted.

I was initially going to say no, that when he went on to damage files, he caused material harm. He was not authorized to "damage" the system, and although he had access to the system and so gaining access in and of itself is not a crime, causing damage would be. But then I looked into the case a bit closer and I start to think he has an argument for not being charged under the CFAA. As with many laws, intent matters,…

If the CFAA doesn't apply to sys admins working at the highest levels of authorization, it seems to be a useless law. Foreign actors can simply hire sys admins to access whatever they want, no need for hacking. I really do think the court has opened Pandora's box on this one. They should've voided the statute for vagueness if that was the concern. As it stands now, it has to be one of the dumbest laws on the books.

[deleted]

Re: Van Buren is a victory against overbroad interpretations of the CFAA

#65

Earlier quoted context omitted.

Perhaps it would be helpful to consider an offline analogy. Suppose there were no computers involved and all the information was stored in files in a locked room. Now Van Buren is given a key to access the filing room for his duties, and then uses his key to go in and look up the file on some license plate in exchange for money. Clearly, this is a terrible breach of trust and authority. It should be against policy. H…

Yeah, I don't buy this line of argumentation. Suppose the locked room is an apartment and the person with a key is your landlord. I'm pretty sure he's not authorized to enter and do whatever. A plain reading of "authorized" means "having official permission or approval." Van Buren might have been "authorized" to access the system but he certainly wasn't "authorized" to access certain data for cash bribes. I guess I'm…

"Yeah, I don't buy this line of argumentation. Suppose the locked room is an apartment and the person with a key is your landlord"

So he would not be Breaking and Entering, and if he has a valid reason such as emergency it would be legal.

There are different crimes with different punishments and it's important the right ones are applied.

Fraud and theft are different. Manslaughter and murder are different. Sexual harrasment and rape are different.

Re: Van Buren is a victory against overbroad interpretations of the CFAA

#66

Earlier quoted context omitted.

Yeah, I don't buy this line of argumentation. Suppose the locked room is an apartment and the person with a key is your landlord. I'm pretty sure he's not authorized to enter and do whatever. A plain reading of "authorized" means "having official permission or approval." Van Buren might have been "authorized" to access the system but he certainly wasn't "authorized" to access certain data for cash bribes. I guess I'm…

"Yeah, I don't buy this line of argumentation. Suppose the locked room is an apartment and the person with a key is your landlord" So he would not be Breaking and Entering, and if he has a valid reason such as emergency it would be legal. There are different crimes with different punishments and it's important the right ones are applied. Fraud and theft are different. Manslaughter and murder are different. Sexual har…

"If a landlord does not give notice to the tenants or enters for an unauthorized purpose, the landlord may be charged with trespassing" [1].

[1] https://www.criminaldefenselawyer.com/resources/can-you-tres...

Re: Van Buren is a victory against overbroad interpretations of the CFAA

#67

Earlier quoted context omitted.

If the CFAA doesn't apply to sys admins working at the highest levels of authorization, it seems to be a useless law. Foreign actors can simply hire sys admins to access whatever they want, no need for hacking. I really do think the court has opened Pandora's box on this one. They should've voided the statute for vagueness if that was the concern. As it stands now, it has to be one of the dumbest laws on the books.

> Foreign actors can simply hire sys admins to access whatever they want, no need for hacking This is prosecutable under a myriad of existing laws. CFAA was specifically crafted to deter and punish hacking. As far as I know, that's still very much a thing.

It's not immediately clear which laws. The whole point of the CFAA was that existing trespass & theft laws don't really work for digital files.

Re: Van Buren is a victory against overbroad interpretations of the CFAA

#68
post #63

Earlier quoted context omitted.

Perhaps it would be helpful to consider an offline analogy. Suppose there were no computers involved and all the information was stored in files in a locked room. Now Van Buren is given a key to access the filing room for his duties, and then uses his key to go in and look up the file on some license plate in exchange for money. Clearly, this is a terrible breach of trust and authority. It should be against policy. H…

>But he's not guilty of breaking and entering He is in my state: >A person commits the offense of criminal trespass when he or she knowingly and without authority: >(1) Enters upon the land or premises of another person or into any part of any vehicle, railroad car, aircraft, or watercraft of another person for an unlawful purpose;

> A person commits the offense of criminal trespass when he or she knowingly and without authority

Note emphasis.

Going in my house without my permission (without authority) to do something illegal is criminal trespass, based on what you quoted. If you have permission to be in my house and do something illegal while in my house then that is not criminal trespass, based on what you quoted. Whatever illegal thing you did is still illegal, but you weren't trespassing.

Exactly the same as what GP and the parent of that said about CFAA. The CFAA, as the Supreme Court clarified with this ruling, makes it illegal to break into a computer system. But if you have permission to be in a computer system and do something illegal with that access, whatever you did is still illegal, but you didn't break into the computer system so you didn't violate the CFAA. Making it an exact digital equivalent of your trespassing law.

Re: Van Buren is a victory against overbroad interpretations of the CFAA

#69
post #63

Earlier quoted context omitted.

>But he's not guilty of breaking and entering He is in my state: >A person commits the offense of criminal trespass when he or she knowingly and without authority: >(1) Enters upon the land or premises of another person or into any part of any vehicle, railroad car, aircraft, or watercraft of another person for an unlawful purpose;

> A person commits the offense of criminal trespass when he or she knowingly and without authority Note emphasis. Going in my house without my permission (without authority) to do something illegal is criminal trespass, based on what you quoted. If you have permission to be in my house and do something illegal while in my house then that is not criminal trespass, based on what you quoted. Whatever illegal thing you d…

It can reasonably argued (and has been argued iirc) that you are not authorized to enter the room if not on official business.

Re: Van Buren is a victory against overbroad interpretations of the CFAA

#70
post #63

Earlier quoted context omitted.

>But he's not guilty of breaking and entering He is in my state: >A person commits the offense of criminal trespass when he or she knowingly and without authority: >(1) Enters upon the land or premises of another person or into any part of any vehicle, railroad car, aircraft, or watercraft of another person for an unlawful purpose;

> A person commits the offense of criminal trespass when he or she knowingly and without authority Note emphasis. Going in my house without my permission (without authority) to do something illegal is criminal trespass, based on what you quoted. If you have permission to be in my house and do something illegal while in my house then that is not criminal trespass, based on what you quoted. Whatever illegal thing you d…

>If you have permission to be in my house and do something illegal

Sure, but having permission to come in for a certain reason doesn't also grant you permission to come back lather for another reason. To use the analogy, the defendant had permission to enter the "house" for certain purposes. They subsequently entered it for an explicitly unauthorized purpose. That latter entry is trespassing.

Post reply on HN