The federal Computer Fraud and Abuse Act, 18 USC sec. 1030, imposes criminal liability for unauthorized access to a computer, or for exceeding authorized access. An en banc panel of the Ninth Circuit last month narrowly interpreted the CFAA, holding that it does not apply to violations of private computer use policies. The opinion sets up a conflict with other federal circuit courts that may end up being resolved by the US Supreme Court.
In US v. Nosal, the defendant was convicted of aiding and abetting a violation of the CFAA after he convinced employees of an executive search firm to give him confidential client information from the firm's database. While the employees were authorized to access the information, their employer's policy prohibited disclosing confidential information to persons outside the company. The validity of the conviction turned on the meaning of the phrases "without authorization" and "exceeds authorized access" in the CFAA.
Defendant argued that the CFAA was intended to criminalize hacking -- unauthorized access to computers -- but not unauthorized use of data that is obtained from a computer through authorized access. The Ninth Circuit agreed that persons with authorized access who violate private computer use policies should not be subject to criminal liability. Judge Alex Kozinski, writing for the majority, set out a "parade of horribles" to justify a narrow reading of the statute, noting that innocent violations of terms of use occur every day: "Minds have wandered since the beginning of time and the computer gives employees new ways to procrastinate, by g-chatting with friends, playing games, shopping or watching sports highlights. Such activities are routinely prohibited by many computer-use policies . . . [and] under the broad interpretation of the CFAA, such minor dalliances would become federal crimes."
The opinion acknowledges that the result creates a conflict with the Fifth, Seventh, and Eleventh Circuits. A dissent by Judge Barry Silverman and Judge Richard Tallman argues that the majority improperly ignores the plain wording of the statute. Further, according to the dissent, criminalization of innocent violations of corporate terms of use is unlikely because the CFAA explicitly requires an intent to defraud.