How Recent Cyber Cases Change Access Rules

TL;DR

Authorized users generally do not violate the Computer Fraud and Abuse Act merely by accessing permitted computer information for an improper purpose. The Supreme Court’s six-to-three Van Buren decision adopted a gates-up or gates-down approach, making technical or physical access barriers more important than policies and contracts for controlling privileged insiders.

Transcript

Okay, great. Good afternoon, everybody. It's so nice to see everybody in person. Welcome to What Have the Courts Done Now? Explaining the Impact of Recent Cyber Cases. Professor Aldrich and I are, uh, very happy to be with you. Um, we are going to kinda keep this moving along because, as is usual, if you've seen us before, or you will certainly exp... Read More

Key Insights

• The Van Buren ruling is a six-to-three Supreme Court decision holding that an authorized police officer did not violate the Computer Fraud and Abuse Act by checking a license plate for an unofficial and improper purpose.
• The Computer Fraud and Abuse Act distinguishes access without authorization from exceeding authorized access. The Court associated the first category with external hackers and the second with insiders who possess some system privileges but attempt to cross applicable access boundaries.
• Authorization is treated by the Court largely as authentication, reflecting the technical meaning associated with the statute’s 1986 context. Passwords, two-factor authentication, and comparable controls can therefore help determine whether information is available to a particular user.
• The gates-up or gates-down approach asks whether a user is permitted to enter a computer location. Once authenticated access is granted, policies or contractual restrictions generally do not make activity within that permitted area an exceeding-authorized-access offense.
• Policies and contracts are generally insufficient to create Computer Fraud and Abuse Act liability when an insider already has the necessary access privileges. The Court did not want criminal consequences to depend on how attorneys drafted behavioral restrictions.
• Physical barriers may contribute to access restrictions because the Court declined to limit authorization controls exclusively to computer code. Its example involved a computer located in a private office protected by a lock, leaving the precise boundaries of valid barriers unclear.
• The Van Buren decision reduces the statute’s usefulness for civil claims against insiders whose objectionable conduct remains within areas they are permitted to access. The Act contains both criminal and civil provisions, and firms have used it to sue insiders.
• Department of Justice charging guidance addresses good-faith, reasonable security research and states that such conduct will not be charged under the described policy. The guidance matters because some interpretations of the statute could otherwise appear broad enough to reach that activity.

Questions & Answers

Q: What did the Supreme Court decide in Van Buren?

The Supreme Court decided, by a six-to-three vote, that Van Buren’s license-plate search did not violate the Computer Fraud and Abuse Act. He had authority to use the plate-checking system, even though he used it for an unofficial purpose connected to a proposed six-thousand-dollar payment. His improper motive did not itself mean that he exceeded authorized access under the statute.

Q: What does exceeding authorized access mean under the ruling?

Exceeding authorized access concerns an insider who has permission to use a computer but tries to obtain or alter information beyond the access available to that person. The Court contrasted this situation with access without authorization, which it associated with an external hacker. The relevant issue is the access boundary, not merely whether the user violated a policy or acted for an improper reason.

Q: What is the gates-up or gates-down approach to computer access?

The gates-up or gates-down approach focuses on whether a user is authenticated or otherwise permitted to enter a computer area. If the gate is up, the user generally does not exceed authorized access by using information available there, even for a prohibited purpose. If the gate is down and the user crosses the boundary, the access may fall within the statute’s prohibition.

Q: Can workplace policies create Computer Fraud and Abuse Act liability?

Workplace policies and contractual terms generally cannot create liability under the Computer Fraud and Abuse Act merely by prohibiting a purpose for which otherwise accessible information is used. The Court resisted making criminal consequences depend on the drafting of policies or contracts. Organizations may still prohibit conduct internally, but those restrictions do not necessarily establish that a permitted user exceeded authorized computer access.

Q: How should organizations restrict privileged insiders after Van Buren?

Organizations should place additional access barriers around systems and information that privileged insiders are not permitted to reach. The discussion identifies passwords, two-factor authentication, other code-based controls, and potentially physical restrictions as relevant boundaries. Giving an insider broad privileges and relying only on policies or contracts may not support a claim that the person exceeded authorized access under the statute.

Q: Why did the meaning of authorization matter in Van Buren?

Authorization mattered because the statutory definition was described as circular, making the scope of prohibited access difficult to determine. The Court considered the technical meaning used around 1986, when the law was written, and connected authorization with authentication. That interpretation shifted attention toward whether a user could enter a computer location, rather than whether the user followed every rule governing permitted access.

Q: Can physical barriers determine whether computer access is authorized?

Physical barriers can matter because the Supreme Court was unwilling to say that authorization must always be enforced through code. The discussion gives the example of a computer inside a private office protected by a lock. This suggests that a meaningful physical restriction may establish an access boundary, although the presenters emphasize that the Court left important details unclear.

Q: How does Van Buren affect civil lawsuits against insiders?

Van Buren makes the Computer Fraud and Abuse Act less useful for some civil lawsuits against insiders who misuse information they were already permitted to access. The statute has both criminal and civil applications, and firms have used it against employees or other insiders. After the ruling, objectionable purpose alone is generally insufficient when the relevant computer access gate was already open to the user.

Summary & Key Takeaways

• The session examines emerging court cases involving transforming technologies, with the stated goal of helping organizations anticipate or recover from changes in cyber law. Its broader coverage includes privacy, cybercrime, electronic discovery, and ransomware, although the provided transcript focuses primarily on the Supreme Court’s interpretation of the Computer Fraud and Abuse Act.

• Van Buren, a police officer authorized to check license plates, accepted a proposed six-thousand-dollar payment to run a plate for an unofficial purpose during an FBI operation. Although the conduct produced several felony charges, the Supreme Court ruled six to three that his permitted access did not violate the Act’s prohibition on exceeding authorized access.

• The Court treated authorization largely as authentication and described access through a gates-up or gates-down framework. Policies or contracts generally cannot convert permitted access into prohibited access solely because the user has an improper purpose. Organizations seeking stronger protection against privileged insiders therefore need additional technical or physical barriers around sensitive systems and information.