[BreachExchange] Supreme Court limits reach of computer hacking law

[Sophia Kingsbury]

https://www.cnet.com/news/supreme-court-limits-reach-of-computer-hacking-law/

In a 6-3 ruling, the US Supreme Court narrowed the scope of the Computer
Fraud and Abuse Act, which is a 34-year-old law on computer hacking.

At issue was the conviction -- which the Supreme Court ruling overturned --
of a former police officer who allegedly received payments in return for
searching for a license plate in a police database. Under CFAA, it is
illegal to "access a computer with authorization and to use such access to
obtain or alter information in the computer that the accesser is not
entitled so to obtain or alter."

In its opinion, delivered by Justice Amy Coney Barrett and issued Thursday,
the court found that while the provision applies to those who "obtain
information from particular areas in the computer -- such as files,
folders, or databases -- to which their computer access does not extend,"
the provision doesn't cover someone who might have "improper motives" for
retrieving information they already have access to.

When the case was argued, one of the concerns cited was that the law as it
stood could make a variety of everyday actions technically illegal, like
using a work Zoom account to make a personal call or sharing a Netflix
password, as those could be interpreted as "exceeding authorized access."

Justices Clarence Thomas, John Roberts and Samuel Alito dissented, arguing
that the police officer exceeded his authorized access when he used the
database "under circumstances that were expressly forbidden."
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20210603/4599249c/attachment.html>