Security News > 2021 > June > The Supreme Court Narrowed the CFAA

In a ruling delivered today, the court sided with Van Buren and overturned his 18-month conviction.

In a 37-page opinion written and delivered by Justice Amy Coney Barrett, the court explained that the "Exceeds authorized access" language was too broad. Justice Barrett said the clause was effectively making criminals of most US citizens who ever used a work resource to perform unauthorized actions, such as updating a dating profile, checking sports scores, or paying bills at work.

What today's ruling means is that the CFAA cannot be used to prosecute rogue employees who have legitimate access to work-related resources, which will need to be prosecuted under different charges.

The ruling does not apply to former employees accessing their old work systems because their access has been revoked and they're not "Authorized" to access those systems anymore.

It's a good ruling, and one that will benefit security researchers.

For present purposes, we need not address whether this inquiry turns only on technological limitations on access, or instead also looks to limits contained in contracts or policies.

News URL

https://www.schneier.com/blog/archives/2021/06/the-supreme-court-narrowed-the-cfaa.html