Security News > 2021 > June > US Supreme Court restricts broad scope of CFAA law

Today, the US Supreme Court restricted the scope of the federal Computer Fraud and Abuse Act after overturning the conviction of a Georgia police officer who searched a police database for money.

The CFAA is a cybersecurity bill created in 1986 that prohibits unauthorized access to computer systems and networks or acts that "Exceeds authorized access." Due to the vague nature of the bill, the CFAA can be broadly interpreted to allow harmless actions such as violating a website's terms of service or violating corporate policies by using work devices to access personal accounts on social sites.

Van Buren's lawyers argued that the police officer had authorized access to the police database and did not exceed the authorized access given to him and should not be convicted under the CFAA. In a 6-3 ruling in favor of Van Buren written by Justice Amy Coney Barret, the Court stated that while Van Buren's actions were improper, they did not exceed his authorized access and did not fall under the CFAA. "We must decide whether Van Buren also violated the Computer Fraud and Abuse Act of 1986, which makes it illegal"to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter," reads the Supreme Court opinion.

In a dissenting opinion written by Justice Thomas and joined by Justice Roberts and Alito, Thomas argued that "The common law and statutory law have long punished those who exceed the scope of consent when using property that belongs to others."

Today's ruling is seen as a step forward for critics of the CFAA and its overly broad interpretation.

"Today's win is an important victory for users everywhere. The Court rightly held that exceeding authorized access under the CFAA does not encompass"violations of circumstance-based access restrictions on employers' computers," the EFF stated in a blog post about the ruling.

News URL

https://www.bleepingcomputer.com/news/security/us-supreme-court-restricts-broad-scope-of-cfaa-law/