SCOTUS’s Decision in Van Buren vs. United States Provides More Freedoms

The Supreme Court of the United States (SCOTUS) made many public rulings this June, as it does every year. In a somewhat surprising decision, the Court narrowly interpreted the 1986 Computer Fraud and Abuse Act overturning a police officer’s conviction. In a 6-3 split, the Supreme Court reversed and remanded the case back to the District Court.

Van Buren vs. United States makes it easier for people who have legal access to computer databases at work (or for any reason) to look for information – even if looking for that information violates workplace policy or the terms of service of a website such as Facebook – without fear of being arrested.

About Van Buren vs. United States

Officer Nathan Van Buren had legal access through his job to a law enforcement database, the Georgia Crime Information Center (GCIC). On one occasion he used that access to run a license plate search for profit (a payment of $6,000) instead of for his law police department. The officer did have the proper credentials to log into the database. Based on those credentials, the database provides a method for obtaining license plate information. The problem for Officer Van Buren is that the police department only authorizes license plate lookups for law-enforcement purposes – not for non-law enforcement reasons.

Officer Van Buren was charged with a felony by federal prosecutors with violating part of the Computer Fraud and Abuse Act, which states that it is a crime for anyone to “intentionally accesses a computer without authorization or exceeds authorized access” in order to obtain computer information. The question that the Supreme Court had to decide was, whose authority was at issue – the police district’s authority over its employees, or the database’s authority over permissible inquiries?

The officer was convicted in federal district court. That conviction was upheld by the 11^th Circuit. Officer Van Buren appealed the conviction to the U.S. Supreme Court.

The basis of the officer’s appeal

The appeal centered around what the words “exceeds authorized access” meant. The statute, according to the Supreme Court’s opinion, defines the term as “to access a computer with authorization and to use such access to obtain … information in the computer that the accesser is not entitled so to obtain or alter” under §1030(e)(6) of the CFAA.

The officer and the police department agreed that Officer Van Buren had authority to access the database, and that he did obtain information from the database. The dispute centered around the definition of the words “not entitled so to obtain.”

Officer Van Buren’s position is that the phrase essentially asks, “Did the officer (or any other person accused of this offense) have a right to the information?” He argues the phrase asks whether he was allowed to obtain the information (once he obtained entry into the database) to obtain the information by use of his authorized access.

The federal prosecutor’s position was that the phrase refers to information “one was not allowed to obtain in the particular manner or circumstances in which he obtained it.” The government argued that “the manner or circumstances in which one has a right to obtain information are defined by any ‘specifically and explicitly’ communicated limits on one’s right to access information.”

Essentially, Van Buren argued that once he was legally in the database, he could access any information that the database is designed to provide. The Government claimed that his entry into the database was conditional on his seeking information that falls within the parameters of his job duties.

The court’s decision in favor of Officer Van Buren

Justice Amy Coney Barrett, writing for the majority, explained “An individual ‘exceeds authorized access’ when he accesses a computer with authorization but then obtains information located in particular areas of the computer—such as files, folders, or databases— that are off-limits to him.” In other words, the officer would have committed a crime if he had hacked into parts of the database that the database wasn’t designed to offer him. Since he looked up the license plate information, he was not guilty of violating the law because the database was designed to provide license plate information to authorized users.

Further, wrote Justice Coney Barrett:

The Government’s interpretation of the ‘exceeds authorized access’ clause would attach criminal penalties to a breathtaking amount of commonplace computer activity. For instance, employers commonly state that computers and electronic devices can be used only for business purposes. On the Government’s reading, an employee who sends a personal e-mail or reads the news using a work computer has violated the CFAA.

The three dissenting justices took the position that the phrase “exceeds authorized access” is dependent on the conditions placed by the property owner (the police department) – based on statutory principles for interpreting laws.

What the Supreme Court decision means for the rest of us

The decision in Van Buren is a good one: it limits prosecutorial overreach while expanding our right to access certain information. The decision means that many of the limited excesses most website users commit – like accidentally violating a website’s Terms of Service Agreement – should not result in criminal charges. It means you cannot go to jail for sharing your Netflix password or adding an extra inch or two to your height on a dating profile. It also means that you cannot be charged for checking your Facebook account at work (though you could still be reprimanded or fired if your employer has rules about that).

The decision’s reach likely protects some information that employers (such as universities) might want to keep private. On the other hand, while the disclosures may not violate the CFAA, they may violate other laws. For example, downloading company customer contact lists may violate trade secret laws.

There are numerous defenses to criminal charges that may apply to your case. The government has to prove its case beyond a reasonable doubt. The government cannot use evidence that was illegally obtained. The government cannot force you to testify against yourself. You may have an alibi or a factual defense. In some cases, such as the Van Buren decision, that statute may not apply to your case.

At The Law Office of Perry A. Craft, PLLC, we pursue every available defense. We work to obtain the dismissal of criminal charges, acquittals, and just plea bargains. If you have been charged with any federal or Tennessee offense, call our Nashville office at 615-551-5565 or fill out our contact form to speak with an experienced strong criminal defense lawyer.