Clarifying the Computer Fraud and Abuse Act

guest · Mar 31, 2020

Clarifying the Computer Fraud and Abuse Act
March 31, 2020
https://www.schneier.com/blog/archives/2020/03/clarifying_the_.html

A federal court has ruled that violating a website's tems of service is not "hacking" under the Computer Fraud and Abuse Act.

"Criminalizing terms-of-service violations risks turning each website into its own criminal jurisdiction and each webmaster into his own legislature," Bates wrote.
Bates noted that website terms of service are often long, complex, and change frequently. While some websites require a user to read through the terms and explicitly agree to them, others merely include a link to the terms somewhere on the page.

Under those circumstances, it's not reasonable to make violation of such terms a criminal offense, Bates concluded.
This is not the first time a court has issued a ruling in this direction. It's also not the only way the courts have interpreted the frustratingly vague Computer Fraud and Abuse Act.
Click to expand...

Court: Violating a site’s terms of service isn’t criminal hacking

[...]
Ultimately, these conflicting interpretations of the CFAA will need to be resolved by the Supreme Court, which has yet to rule on the question.

Last week's ruling only deals with criminal liability under the CFAA. There's a separate question about whether violating a website's terms of service could expose someone to a lawsuit from the site's owner. Here, too, the courts have yet to reach a clear answer.
Click to expand...

guest · Apr 7, 2020

Federal Judge Rules It Is Not a Crime to Violate a Website’s Terms of Service
April 6, 2020
https://www.eff.org/deeplinks/2020/...s-it-not-crime-violate-websites-terms-service

In a highly anticipated decision, a federal judge in Washington, D.C. has ruled that violating a website’s terms of service does not violate the Computer Fraud and Abuse Act (CFAA), the notoriously vague federal computer crime law. This decision solidifies the trend in courts to reject overbroad and constitutionally troublesome interpretations of the CFAA that have threatened to criminalize innocuous online activity, such as beneficial research and journalism.

If you’re not familiar with the CFAA, you may be wondering how is it possible that a law meant to target serious computer breaks-ins is being abused to target violations of websites’ terms of service. The CFAA makes it a crime to “access a computer without authorization” or in a manner that “exceeds authorization.” But the law doesn’t make clear what these phrases mean.
Click to expand...

This decision is therefore not only critical for protecting beneficial research and journalism, but it is also an important victory in the ongoing fight for algorithmic transparency and accountability.
Click to expand...

guest · Apr 14, 2020

Another Court Significantly Limits the Scope of Criminal CFAA–Sandvig v. Barr
April 14, 2020
https://blog.ericgoldman.org/archiv...the-scope-of-criminal-cfaa-sandvig-v-barr.htm

The plaintiffs want to create fake job profiles to research algorithmic discrimination. Fearing that their research activities would expose them to criminal CFAA prosecution, they challenged the CFAA as violating their First Amendment rights. Venkat blogged a preliminary ruling in the case 2 years ago.
Now, the court dismisses the researchers’ suit as moot and sidesteps the First Amendment challenge. Nevertheless, the researchers still won this ruling, because the court says that TOS violations can’t support criminal CFAA prosecutions.

What Does the CFAA Cover? The CFAA prohibits access to a computer “without authorization.” [...]
Following hiQ v. LinkedIn, the court says “the barriers between the public internet and private authorization-based computers” are called “permission requirements.” The court emphatically concludes that TOS cannot constitute “permission requirements” for criminal CFAA purposes for at least three reasons: [...]
Click to expand...

More generally, this ruling represents another step in the waning of the CFAA in the courts. We are getting closer to the scenario where the CFAA only protects against hacking-type attacks. I advocated for that result in 2013, but I thought it would require a statutory amendment. Seeing cases like hiQ and now Sandvig shredding the CFAA, maybe not.

Though I’m happy to see the CFAA’s waning, I’m increasingly baffled how to teach the CFAA to my Internet Law students. It’s easy enough to teach them that authorization is based on a “permission requirement.” How can they apply that legal standard in the field?
Click to expand...

guest · Apr 20, 2020

Supreme Court to Review CFAA For First Time
April 20, 2020
https://duo.com/decipher/supreme-court-to-review-cfaa-for-first-time

For the first time, the United States Supreme Court has agreed to review a case involving the Computer Fraud and Abuse Act (CFAA), the highly controversial anti-hacking law that many in the civil liberties and digital rights communities have argued is overly broad and punitive. The case could be a landmark in the decades-old effort to narrow the scope of the CFAA.

On Monday, the court granted a petition from Nathan Van Buren, a former police officer in Georgia, to review his case, which involved a charge under the CFAA that he had exceeded his authorized access to a police database. The charge resulted from an FBI sting operation that included recorded conversations between Van Buren and an acquaintance named Andrew Albo who asked Van Buren to run a database search on a license plate number purportedly belonging to a woman he was interested in.

[...] Van Buren ran the license plate number through the Georgia Crime Information Center database, which he had official access to as a law enforcement officer.
He was later charged under the CFAA and convicted.
Click to expand...

The CFAA is 34 years old and was written at a time when few people had access to computers, let alone had one of their own. For many years, legal scholars have argued that the key language in the law is too broad and encompasses too many types of activity that aren’t malicious hacking.
“The courts of appeals are openly divided four-to- three over whether a person with permission to access information on a computer violates the Computer Fraud and Abuse Act when he accesses that information for an improper purpose. [...]”

CFAA prosecutions are very common, and a non-trivial number of them involve activities that have nothing to do with malicious hacking but rather are related to alleged misuse of resources or access to information

“Security researchers frequently encounter website terms of service and other agreements that technically prohibit their valuable work. Too often, the CFAA is used as a cudgel to stop the public from learning of vulnerabilities, and even the threat of litigation or prosecution chills research from ever getting started.”
Click to expand...

guest · Apr 30, 2020

U.S. Supreme Court Will Finally Weigh in on Scope of CFAA
April 28, 2020
https://www.workplaceprivacyreport....court-will-finally-weigh-in-on-scope-of-cfaa/

The United States Supreme Court recently granted a petition for certiorari in Van Buren v. United States addressing the issue of whether it is a violation of the Computer Fraud and Abuse Act (“CFAA”) when an individual who is authorized to access information on a computer, accesses the same information for an improper purpose.
The Supreme Court will have a chance to resolve the long-standing circuit split regarding the scope of the CFAA.

Jackson Lewis’s Privacy, Data and Cybersecurity practice group, in conjunction with the Non-Competes and Protection Against Unfair Competition practice group, published an article on the Jackson Lewis website, explaining the Van Buren case and its potential impact.
Click to expand...

Regardless of how the Supreme Court rules in Van Buren, employers should consider reviewing and clarifying their policies concerning which employees have access to what data, particularly in light of the spike in remote work. We will monitor the Van Buren case and provide updates.
Click to expand...

guest · May 16, 2020

US Computer Fraud and Abuse Act: How an upcoming Supreme Court ruling could have serious ramifications for ethical hackers
‘Authorized access’ debate may impact security researchers and pen testers who probe US-based technologies
May 15, 2020
https://portswigger.net/daily-swig/...ave-serious-ramifications-for-ethical-hackers

CFAA split
“Right now, the courts in the United States are split,” on what constitutes a CFAA violation, Gabriel Ramsey, partner at the San Francisco office of law firm Crowell & Moring, told The Daily Swig – something the Van Buren case could settle for a generation.
Some circuit courts “require much more technical programmatic hacking”, while others “say it’s enough to violate the terms of service or an agreement,” said Ramsey.
Implications for security researchers
Whether the Supreme Court agrees with the Eleventh Circuit’s rejection of Van Buren’s defense – that he was “innocent of computer fraud because he accessed only databases that he was authorized” to access – potentially has implications for security researchers, said Ramsey.

“The core question the Supreme Court is going to resolve” is whether the act “requires some technical step” – or “hacking as we know it” – in order “to violate the statute”, or whether a violation of some form of data use policy, employment agreement restricting data use, or similar agreements such as the terms of service is enough.”
Nevertheless, if the Supreme Court favors a “broader interpretation”, then it “could be risky” for a pen tester to flout any “terms and conditions” constraining their activities.
Click to expand...

Is the CFAA fit for purpose?
Whichever way the Supreme Court leans in the Van Buren and HiQ cases, Ramsey is clear that a law devised several years before the World Wide Web was born is not entirely fit for purpose in 2020.

“Legislators need to work from the ground up with an overhaul of this statute,” he explains.
“The basic architecture” of computers and computing networks “is the same”, he adds, “but the way people use” computers, networks, and data, and “the spectrum of accessibility, is way less binary than it was in the 1980s. It’s this massive spectrum that the law didn’t account for.”
Click to expand...

guest · Jun 6, 2020

Terms of engagement: US computer crime laws out of step with changing attitudes to pen tests, ethical hacking
June 5, 2020
https://portswigger.net/daily-swig/...anging-attitudes-to-pen-tests-ethical-hacking

ANALYSIS Progress in reducing any hostility that security researchers face for breaking into networks, applications, and devices for the benefit of users and businesses has been uneven.

On the one hand, awareness of the existence and merits of white hat hackers has grown in the nearly 10 years since US bug bounty platforms HackerOne and Bugcrowd were founded.
On the other, US courts are still wrangling over how to interpret anti-hacking legislation passed three years before the world’s first commercial provider of dial-up internet access emerged.

As The Daily Swig explored recently, a forthcoming Supreme Court ruling could settle that argument for a generation, but this is unlikely to satisfy advocates of more fundamental reform. [...]
Click to expand...

guest · Jul 5, 2020

Extraterritorial Application of the Computer Fraud and Abuse Act
July 3, 2020
https://www.natlawreview.com/article/extraterritorial-application-computer-fraud-and-abuse-act

A brazen and sophisticated computer intrusion into the records of over 145 million Americans launched from computer hackers based in China led to recent criminal prosecutions under the Computer Fraud and Abuse Act.

The Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (“CFAA”), is one such statute that provides criminal and civil remedies resulting from unauthorized access to computers used in interstate commerce or communications.[3] And, it further provides for extraterritorial jurisdiction for criminal or civil violations of the CFAA.
Click to expand...

The fact that computer abuse is largely intangible and can be launched from anywhere in the world presents the jurisdictional question whether the CFAA can be applied extraterritorially to prosecute those who perpetrate computer abuse in the U.S. from a foreign land.
Although case law here is sparse, a Connecticut district court concluded that it had jurisdiction to hear a claim against a Russian national under the Act.

The CFAA’s potential reach goes beyond U.S. borders and packs a jurisdictional punch that will likely be able to bring a foreign party into an American court. Thus, a computer hacker outside the U.S. who causes injury[26] here is likely not immune from a civil or criminal action.
Click to expand...

guest · Jul 18, 2020

Researchers warn court ruling could have a chilling effect on adversarial machine learning
July 17, 2020
https://venturebeat.com/2020/07/17/...lling-effect-on-adversarial-machine-learning/

A cross-disciplinary team of machine learning, security, policy, and law experts say inconsistent court interpretations of an anti-hacking law have a chilling effect on adversarial machine learning security research and cybersecurity. At question is a portion of the Computer Fraud and Abuse Act (CFAA). A ruling to decide how part of the law is interpreted could shape the future of cybersecurity and adversarial machine learning.

One circuit court ruling on the subject concluded that a broad view would turn millions of people into unsuspecting criminals.

“If we are correct and the Supreme Court follows the Ninth Circuit’s narrow construction, this will have important implications for adversarial ML research. In fact, we believe that this will lead to better security outcomes in the long term,” the researchers’ report reads.
“With a more narrow construction of the CFAA, ML security researchers will be less likely chilled from conducting tests and other exploratory work on ML systems, again leading to better security in the long term.”
Click to expand...

The researchers found that virtually every form of known adversarial machine learning can be defined as potentially violating CFAA provisions. They say CFAA is most commonly relevant to adversarial machine learning researchers due to sections 1030(a)(2)(C) and 1030(a)(5) of the CFAA.
Specifically in question are provisions related to defining what activity is defined as exceeding authorized access to a “protected computer” or causing damage to a “protected computer” by “knowingly” transmitting a “program, information, code, or command.”
Click to expand...

The U.S. Supreme Court has not yet decided what cases it will hear in the 2021 term, but researchers believe the Supreme Court could take up Van Buren v. United States, a case involving a police officer who allegedly attempted to illegally sell data obtained from a database. Each new term of the U.S. Supreme Court begins the first Monday of October.
Click to expand...

guest · Sep 3, 2020

Surprise! Voting app maker roasted by computer boffins for poor security now begs US courts to limit flaw finding
We should be able to outlaw unauthorized inquiry, Voatz argues
September 4, 2020
https://www.theregister.com/2020/09/04/voatz_supreme_court/

Voatz, the maker of a blockchain-based mobile election voting app pilloried for poor security earlier this year, has urged the US Supreme Court not to change the 1986 Computer Fraud and Abuse Act (CFAA), a law that critics say inhibits security research because it's overly broad.

The app maker filed an amicus brief [PDF] on Thursday in Van Buren v. United States in support of the US government, which seeks to uphold the 2017 conviction of former Georgia police officer Nathan Van Buren under the CFAA.
Van Buren was convicted of violating the CFAA for conducting a computer search for a license plate number. [...] The license was a fake, and Van Buren was collared.
Click to expand...

Coincidentally, its app was slammed in February by computer scientists for a variety of security flaws. And it cites that uninvited scrutiny by MIT's computer scientists in its filing as an example of the problematic nature of unauthorized security inquiry.

These are roughly the last people I would go to for advice on what would "harm computer security". More of an inimicus brief if you ask me.
— matt blaze (@mattblaze) September 3, 2020
Voatz goes on to argue that allowing security researchers to violate rules and policies upends the expectations of companies setting those policies, as if their words should be law.
Click to expand...

In an email to The Register, Daniel Weitzner, Founding Director of the MIT Internet Policy Research Initiative, and one of the three authors of the Voatz app analysis [PDF], opposed the idea of letting companies criminalize security testing in their terms of service.

"The vagueness and potential breadth of the Computer Fraud and Abuse Act made it considerably more difficult for us to conduct our security analysis," said Weitzner.
"Allowing tech companies to threaten criminal action for violations of policies that the companies write themselves places independent research in constant jeopardy. [...]"
Click to expand...

guest · Sep 16, 2020

Cyber leaders urge SCOTUS to narrow CFAA scope to protect vulnerability research tactics
September 15, 2020
https://www.scmagazine.com/home/sec...ity-leaders-urge-scotus-to-narrow-cfaa-scope/

Leaders from both the private and public sectors united to oppose an amicus brief filed with the Supreme Court that they say advocates a broad interpretation of the Computer Fraud and Abuse Act (CFAA) and could peg independent security researchers as threats.

The coalition contended that a recent filing by blockchain voting company Voatz in Van Buren v. United States fundamentally misrepresented “widely accepted practices in security research and vulnerability disclosure, and that the broad interpretation of the CFAA threatens security research activities at a national level.”
Click to expand...

At issue in Van Buren, set to be heard by the court in October, is whether it is a federal crime for someone with permission to access information on a computer to do so for an improper purpose. The case could modernize and alter the scope of the Computer Fraud and Abuse Act (CFAA).

“A broad interpretation of the CFAA would magnify existing chilling effects, even when there exists a societal obligation to perform such research,” the group wrote in a formal letter to the court.
Click to expand...

Response to Voatz’s Supreme Court Amicus Brief

On September 3, 2020, Voatz — a blockchain voting company with a publicly documented track record of hostility towards security research[1] — filed an amicus brief with the U.S. Supreme Court in Van Buren v. United States arguing in favor of a broad interpretation of the Computer Fraud and Abuse Act (CFAA), the federal anti-hacking law enacted in 1986.[2],[3]

Voatz’s amicus brief repeatedly refers to independent good-faith security research as a threat to cybersecurity and glosses over harmful effects to security research that would result from an overbroad CFAA.
Click to expand...

Voatz’s actions threatening good-faith security research are indicative of what may come should the Court decide that a breach of contractual terms constitutes a criminal CFAA violation.
We cannot afford to lose the benefits of security research on our digital and physical safety, and our democracy as a whole. Thus, we urge the Court to adopt a narrow interpretation of the CFAA in support of the petitioner.
Click to expand...

guest · Nov 29, 2020

The Supreme Court will hear its first big CFAA case
November 29, 2020
https://techcrunch.com/2020/11/29/supreme-court-van-buren-hacking/

The Supreme Court will hear arguments on Monday in a case that could lead to sweeping changes to America’s controversial computer hacking laws — and affecting how millions use their computers and access online services.

The Computer Fraud and Abuse Act was signed into federal law in 1986 and predates the modern internet as we know it, but governs to this day what constitutes hacking — or “unauthorized” access to a computer or network. The controversial law was designed to prosecute hackers, but has been dubbed as the “worst law” in the technology law books by critics who say it’s outdated and vague language fails to protect good-faith hackers from finding and disclosing security vulnerabilities.
Click to expand...

Orin Kerr, a law professor at the University of California, Berkeley, said Van Buren vs. United States was an “ideal case” for the Supreme Court to take up. “The question couldn’t be presented more cleanly,” he argued in a blog post in April.
The Supreme Court will try to clarify the decades-old law by deciding what the law means by “unauthorized” access. But that’s not a simple answer in itself.
How the Supreme Court will determine what “unauthorized” means is anybody’s guess.

But the Supreme Court’s eventual ruling could also have broad ramifications on good-faith hackers and security researchers, who purposefully break systems in order to make them more secure.
Click to expand...

guest · Nov 30, 2020

Supreme Court hears case on hacking law and its limits
The "dangerously vague" Computer Fraud and Abuse Act, established in 1986, gets a look 34 years la
November 30, 2020
https://www.cnet.com/news/supreme-court-hears-case-on-hacking-law-and-its-limits/

For the first time, the US Supreme Court on Monday heard arguments surrounding a 34-year-old law on computer hacking -- examining how the terms of the Computer Fraud and Abuse Act mean everyday activities like browsing Instagram on a work computer could be interpreted as a federal crime.

The Supreme Court's hearing on Monday stems from a case in Georgia, in which former police officer Nathan van Buren allegedly took payments to search for a license plate in a police database. He was convicted of violating the CFAA for allegedly exceeding his authorized access to the police database.
Click to expand...

He cited a number of examples of how someone could run afoul of the CFAA: using a work account for Zoom for personal reasons, lying on a dating website or using a work device to check social media.

"Imagine a secretary whose employee handbook says her email or Zoom account may be used only for business purposes," Fisher said. "Any employee who used a Zoom account over Thanksgiving to connect with distant relatives would be subject to federal prosecutors."
The Department of Justice's deputy solicitor general Eric Feigin argued that the scenarios that Fisher raised were a "wild caricature" of the law that haven't happened in the CFAA's decades-long history.
Feigin argued that the law has only been used for serious crimes like Van Buren's alleged police database abuse.
Click to expand...

"Dangerously vague"
Until the CFAA is changed to explicitly state that discretion or until the Supreme Court makes a decision, the law creates a gray area where people could be considered criminals for everyday activities.

Justice Sonia Sotomayor raised this issue during the hearing, telling Feigin that the CFAA's ambiguity raises concerns.

"My problem is that you are giving definitions that narrow the statute that the statute doesn't have," Sotomayor said. "You're asking us to write definitions to narrow what could otherwise be viewed as a very broad statute and dangerously vague."
Click to expand...

hawki · Nov 30, 2020

mood said: ↑

Supreme Court hears case on hacking law and its limits
The "dangerously vague" Computer Fraud and Abuse Act, established in 1986, gets a look 34 years la
November 30, 2020
https://www.cnet.com/news/supreme-court-hears-case-on-hacking-law-and-its-limits/
Click to expand...

FYI:

You can listen to a recording of the Supreme Court argument here:

https://www.c-span.org/video/?477429-1/van-buren-v-united-states-oral-argument

Log in or Sign up

Clarifying the Computer Fraud and Abuse Act

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

Log in or Sign up

Clarifying the Computer Fraud and Abuse Act

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

Useful Searches