Andrew Hinkes is an attorney with Carlton Fields and is an adjunct professor at the New York University Stern School of Business and New York University School of Law.
This summer, the U.S. Supreme Court will consider how to interpret the 1986 Computer Fraud and Abuse Act, a key data protection law. The court’s decision could criminalize common but technically prohibited computer-related conduct, put limitations on a powerful law that punishes insider data theft and abuse like exchange hacks, or come down somewhere in the middle.
At issue in United States v. Van Buren is the interpretation of a provision of the CFAA, [18 U.S.C. § 1030(a)(2)(C)], which makes it a federal crime to “access[] a computer without authorization or exceed[] authorized access,” and “thereby obtain[] information from any protected computer.” To “exceed[] authorized access” means “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.”
The case was initiated by a Georgia police officer, Nathan Van Buren, who was authorized to access and search a police database for law enforcement purposes but instead accessed that database to identify a person in exchange for payment by a private citizen. Van Buren was charged criminally with a violation of the CFAA.
Van Buren argued that “accessing [information] for an improper or impermissible purpose does not exceed authorized access as meant by” the CFAA. The government argued that “a defendant violates the CFAA not only when he obtains information that he has no ‘rightful[]’ authorization whatsoever to acquire, but also when he obtains information ‘for a nonbusiness purpose.’”
Van Buren was convicted at trial of violating the CFAA. On appeal, his conviction was upheld by the Eleventh Circuit Court of Appeals based on United States v. Rodriguez, which holds that a person with access to a computer for business reasons “exceed[s] his authorized access” when he “obtain[s] ... information for a nonbusiness reason.”
Not all circuit courts of appeal interpret that provision of the CFAA the same way. The First, Fifth, Seventh and Eleventh Circuits have imposed liability where an authorized person accesses data on a system with authorization and exceeds that authorization by obtaining information for an improper purpose. The Second, Fourth and Ninth Circuits have ruled a person violates that portion of the CFAA only if he accesses information on a computer that he is prohibited from accessing for any reason.
Van Buren’s appeal asks the U.S. Supreme Court to decide on this split and determine “[w]hether a person who is authorized to access information on a computer for certain purposes violates [the CFAA] if he accesses the same information for an improper purpose.”
What's at stake
Resolving this conflict is important.
The position taken by the Eleventh Circuit may protect crypto users in case of insider theft. For example, if an insider at a crypto exchange has the right to access customer data or private keys and uses that access for an improper purpose (i.e. to sell that data on the dark web), that insider could be charged under the CFAA and subject to criminal penalties.
However, it has been argued this interpretation could criminalize common conduct such as operating "March Madness" betting pools on employer-owned computers in violation of company policies, and activities that are not illegal but are contractually prohibited such as lying about your height on an online dating site in violation of the website’s terms of service.
See also: JP Koning - The $10B Stablecoin Industry Has a Fraud Problem It’s Not Addressing
This broad interpretation has been attacked in Van Buren as problematic from a constitutional perspective on the grounds that it can transform a violation of a private agreement into a criminal offense and raise due process issues.
From a crypto perspective, the broad (11th Circuit) interpretation may suggest a trader on a crypto exchange who spoofs, churns or wash trades (actions that may violate applicable commodities law but which are rarely punished) may be subject to criminal liability under the CFAA if that activity violates the exchange’s terms of use. This interpretation could also criminalize 51% attacks against public network blockchains if a court viewed the consensus rules, software and work contributed by miners to form implied contracts that prohibit such conduct.
Under this broader interpretation, intermediaries such as exchanges or custodians that grant insiders access to valuable information may attempt to protect themselves and their information by updating their policies to expressly prohibit insiders from using that information for any non-business purpose. These companies may also seek to confirm that their insurance policies cover any potential violations.
The narrower interpretation promoted by Van Buren would limit the application of the CFAA to access without authorization, regardless of use. This interpretation restricts the application of criminal penalties to conduct that is more like “traditional” hacking, and may reduce the possibility that minor violations of boilerplate agreements could be treated as federal crimes. This interpretation could limit claims against insiders who have the authority to access data and use that data for an improper purpose.
The CFAA can be a powerful weapon against hackers. It could allow civil parties to sue and enable prosecutors to seek criminal penalties, including potential incarceration of violators for up to five years. Limitations on the CFAA’s reach could deprive prosecutors of a tool to punish data breaches and insider attacks.
Like many other computer-related federal laws, the CFAA pre-dates the modern internet and is showing its age. Although there may be reason to suggest a modernization of the law to better fit the current internet- enabled business world, courts, parties and prosecutors alike continue to rely on the CFAA to protect computers, data and online assets. A variety of industries and interests, including the crypto world, should await the court’s verdict with interest. The outcome could have big implications for the cryptocurrency industry, which increasingly relies on legally enforceable privacy rights and the power of the law to ensure that intermediaries properly secure their customer’s digital assets.