Van Buren v. United States (19-783)

argument 19-783

Van Buren v. United States

Supreme Court of the United States 1h 6m 8 speakers 8 chapters transcribed 7 days ago official recording ↗

▲ 0

Transcript

jump: chapters · speakers · find in transcript

Transcript

Transcript generated automatically by AI and may contain errors.

What is the CFAA and how does the government define “exceeds authorized access”?

John G. Roberts 0:00

We'll hear argument next in case nineteen seven eighty three, Van Buren versus United States. Mr Fisher.

Unknown 0:08

Mr Chief Justice, I may it please the court. The CFAA is an anti hacking statute. It prohibits obtaining information from a computer without authorization. And to ensure comprehensive coverage, the statute also prohibits quote exceeding authorized access. As Judge Kuzinski put it, the sa this ensures that the statute covers not just outside but also inside hackers. In this case, however, the government seeks to transform the supplemental prong of the CFAA into an entirely different prohibition. In the government's view, this prong covers obtaining any information via a computer that the accessor is not entitled, quote, under the circumstances, unquote, to obtain. It is no overstatement to say that this construction would brand most Americans criminals on a daily basis.

Unknown 0:53

The scenarios are practically limitless, but a few examples will suffice. Imagine a secretary whose employee handbook says that her email or Zoom account may be used only for business purposes. Or consider a person using a dating website where users may not include false information on the profiles to obtain information about potential mates. Or think of a law student who has issued a log login credentials for Westlaw or Lexus for educational use only. If the government is right, then a computer user who disregards any of these stated use restrictions commits a federal crime. For example, any employee who used a Zoom account over Thanksgiving to connect with distant relatives would be subject to the grace of federal prosecutors.

Unknown 1:34

The main argument the government offers in response to that startling result is that a single two letter word in the CFEA's definition of exceeds authorized access, the term so demands it. But that word requires no such thing. The word simply clarifies that a c used the that the user must be prohibited from obtaining the information merely via computer. It relieves the government of having to negate every possible alternative means by which the defendant might permissibly have obtained the information at issue. But that is all the word does. It does not transform the CFAA into a s sweeping internet police mandate. The court should reverse. And I'm happy to take my questions.

John G. Roberts 2:15

In Musaccio versus United States, this is what we said. That statute provides two ways of committing the crime of improperly accessing a protected computer, obtaining access without authorization, and obtaining access with author authorization, but then using that access uh improperly. You you didn't mention that case in your opening brief. The government relied on it. You didn't mention it in your reply brief. I wonder what your your answer to that quote is.

Unknown 2:46

Mr. Chief Justice, my understanding in that case was the court was simply uh giving a thumbnail summary of how the statute works. Of course, the question presented here was not presented there, and in fact, not even the exceeds authorized access prong was at issue there and the conspiracy issue the court reached. I understood what the court to be doing in that summary simply to be using the word improperly as a shorthand for whatever it is that the exceeds authorized access prong prohibits and then moving and moving right along. Well but that's not

John G. Roberts 3:17

what it that's not what it says. It says and this seems to me to go to the point at issue here that the second way you can violate it is by obtaining access with authorization, but then using that access improperly. Does it go ahead?

Unknown 3:32

I'm sorry. Um I think my answer would simply be just to look at the words of the statute. And I think the definition of exceeds authorized access doesn't talk about improper use. It talks about obtaining information that the accessor is not entitled so to obtain. And as we've explained in our papers, we think the definition of that term leaves out improper purposes because we know Congress in fact had those line those words in the very original uh provision of the statute and they took them out in nineteen eighty six.