Cop’s Nosing Around of Database Isn’t Computer Crime, High Court Rules

The court was divided Thursday on whether a police sergeant violated the law, as well as department policy, when he accessed license plate information as part of a bribe.

(Image courtesy of Georgia Department of Motor Vehicles via Courthouse News)

WASHINGTON (CN) — A Georgia police sergeant who took a bribe to access license plate information prevailed at the Supreme Court, overturning his conviction under the Computer Fraud and Abuse Act.

The case stems from a sting operation that the FBI had arranged back in 2015 after hearing a recording that captured police Sergeant Nathan Van Buren asking Andrew Albo, a civilian known to the department, for a personal loan. To see how far Van Buren would go, agents directed Albo to offer the sergeant $5,000 if he would access the police department’s license plate database.

All went according to plan, with Albo saying he needed the records to determine whether he had been approached by a prostitute or a police officer trying to set him up. When Van Buren ran the plates and called Albo to deliver his findings, the government brought a charge under a section of the Computer Fraud and Abuse Act, or CFAA, that outlines the criminality of fraudulent access with authorized use.

Van Buren was convicted and given an 18-month sentence that the 11th Circuit later upheld. Reversing that outcome Thursday, however, the Supreme Court emphasized that Section 1030(a)(2) “covers those who obtain information from particular areas in the computer — such as files, folders, or databases — to which their computer access does not extend.”

“It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them or the authorization given to him by the police department,” Justice Amy Coney Barrett wrote for the the 6-3 court.

Van Buren’s reversal follows oral arguments in November last year. In a dissenting opinion, Justice Clarence Thomas called the CFAA a natural extension of law that has “long punished those who exceed the scope of consent when using property that belongs to others.”

“A valet, for example, may take possession of a person’s car to park it, but he cannot take it for a joyride,” Thomas wrote, joined by Chief Justice John Roberts and Justice Samuel Alito.

Thomas later brought up the example of trespass. “What is true for land is also true in the computer context; if a company grants permission to an employee to use a computer for a specific purpose, the employee has no authority to use it for other purposes,” the dissent argues.

Employing yet more hypotheticals, Thomas questioned what the majority’s reading would mean for a
“person who, minutes before resigning, deletes every file on a computer.”

“So long as an employee could obtain or alter each file in some hypothetical circumstance, he is immune,” the justice scoffed.

But Barrett focused on the technological advances that have occurred in the 30-odd years since Congress adopted the CFAA, saying “the government’s interpretation of the statute would attach criminal penalties to a breathtaking amount of commonplace computer activity.”

“If the ‘exceeds authorized access’ clause criminalizes every violation of a computer-use policy, then millions of otherwise law-abiding citizens are criminals,” Barrett wrote. “Take the workplace. Employers commonly state that computers and electronic devices can be used only for business purposes.
So on the government’s reading of the statute, an employee who sends a personal e-mail or reads the news using her work computer has violated the CFAA.”

Thomas meanwhile said that discomfort with the sweep of the law is no reason to reimagine it.

“Under the majority’s reading,” Thomas wrote later, “so long as a scientist may obtain blueprints for atomic weapons in at least one circumstance, he would be immune if he obtained that data for the improper purpose of helping an unfriendly nation build a nuclear arsenal. It is difficult to see what force this provision — in place in substantially similar form since 1984 — has under the majority’s reading.”

Thomas ended the dissent by running through a huge swathe of federal code that criminalizes common activity.

“This Act thus penalizes mine-run offenders about as harshly as federal law punishes a person who removes a single grain of sand from the National Mall, breaks a lamp in a Government building, ibid.; or permits a horse to eat grass on federal land,” he wrote. “The number of federal laws and regulations that trigger criminal penalties may be as high as several hundred thousand. It is understandable to be uncomfortable with so much conduct being criminalized, but that discomfort does not give us authority
to alter statutes.”

Van Buren was represented by Jeffrey Fisher with the Stanford Law School Supreme Court Litigation Clinic. The attorney

“We’re very pleased with the Court’s opinion and are happy that the CFAA is now restricted to its proper reach,” Fisher wrote in an email Thursday.

A representative for the Justice Department did not immediately return a request for comment.

%d bloggers like this: