Supreme Court Draws Limit to Anti-Hacking Law

WASHINGTON—The Supreme Court Thursday narrowed the scope of a federal anti-hacking law, ruling that it doesn’t cover individuals who use their authorized access to obtain information for improper purposes.

The decision came in the case of a police officer who ran a woman’s license plate in exchange for cash from a man, something that “plainly flouted his department’s policy,” Justice Amy Coney Barrett wrote for a 6-3 court. But his action didn’t violate the Computer Fraud and Abuse Act of 1986, which authorizes up to 10 years imprisonment for anyone who “intentionally accesses a computer without authorization or exceeds authorized access” to obtain computer information.

In a 20-page opinion that, among other features, focused on the grammatical significance of the modifier “so,” Justice Barrett drew a sharp distinction: The law covers people who, although they are authorized to use a computer system, obtain files that are off-limits to them. But it doesn’t reach those who are entitled to access particular information—like Nathan Van Buren, a former Cumming, Ga., police sergeant who was authorized to use the motor-vehicle database—even if they misuse the data they pull.

To read the law more broadly “would attach criminal penalties to a breathtaking amount of commonplace computer activity,” Justice Barrett wrote. “Employers commonly state that computers and electronic devices can be used only for business purposes. So on the Government’s reading of the statute, an employee who sends a personal e-mail or reads the news using her work computer has violated the CFAA,” she wrote.

Likewise, many websites and online services impose fine-print terms and conditions that sweep broadly but rarely are read. The government’s theory would “criminalize everything from embellishing an online-dating profile to using a pseudonym on Facebook,” Justice Barrett wrote, citing an argument that University of California, Berkeley, law professor Orin Kerr raised in a friend-of-the-court brief.