While it can be hard to remember in a world dominated by COVID-19 headlines, the wheels of justice have not stopped turning at the Supreme Court—even if Justices are now hearing argument remotely. On Monday, April 20, SCOTUS granted a petition for certiorari in a case that may finally provide clarity to a question that has troubled defense attorneys and trade secrets practitioners alike for many years: what does it mean to “exceed authorized access” under the Computer Fraud and Abuse Act?
The underlying case
In 2017, former Georgia police sergeant Nathan Van Buren was convicted of violating the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030 et seq., after he searched the Georgia Crime Information Center database at the request of an acquaintance who paid him $6,000 to search for an exotic dancer’s license plate. The government successfully argued at trial that even though Van Buren had access to the database through his job, he was not authorized to access it for reasons other than legitimate law enforcement purposes. In the Eleventh Circuit, like some others, such activity is considered conduct exceeding one’s authorized access to a protected computer, and is thus a violation of the CFAA.
The Eleventh Circuit is not alone—courts in the First, Fifth, and Seventh Circuits interpret “exceeds authorized access” similarly. But the Second, Fourth, and Ninth Circuits (as well as a handful of district courts in the Third, Eighth, and Tenth Circuits) interpret this phrase much more narrowly. In the latter jurisdictions, a violation of the CFAA based on an individual’s conduct exceeding authorized access to a computer is more or less limited to computer hacking.
Why is a defendant’s quest to overturn his criminal conviction relevant to readers of this blog? While the CFAA is primarily a criminal statute, it provides a civil cause of action for any person or entity that suffers damages or loss by a violation of the statute. As a result, over the years, employers have frequently used the CFAA to assert a claim against a former employee who has misappropriated confidential information. Especially before the Defend Trade Secrets Act was enacted and provided an independent basis for federal jurisdiction, a CFAA claim was often the best—or only—way for an employer to litigate in federal court (often the preferred forum), at least in those circuits that construe “exceeds authorized access” broadly.
As a result of the split in reading the CFAA’s language, conduct that is a violation in, for example, the First Circuit is often not a violation in, say, the Second Circuit. In light of the ever-increasing prevalence of business performed in multiple jurisdictions, this inconsistency can predictably lead to forum shopping, especially in the civil context. In other words, a Boston-based company looking to sue its New York-based employee for misappropriating confidential information would presumably sue in the United States District Court for the District of Massachusetts, where its CFAA claim would be viable (unlike in the United States District Court for the Southern District of New York). And on the other side of the equation, the defendant would have an even greater incentive to move for a transfer from D. Mass. to S.D.N.Y, knowing that an S.D.N.Y. judge would likely dismiss the CFAA claim given the Second Circuit’s narrow interpretation of the statute.
Van Buren’s petition for cert
The circuit split has endured for years, and given the lack of intervention from the Supreme Court or legislative action to clarify the statutory language, it appeared that it would continue—until Van Buren’s conviction, that is. Van Buren unsuccessfully appealed his conviction to the Eleventh Circuit, but even that court’s decision affirming his conviction foreshadowed the Supreme Court’s decision to take this matter up to resolve the raging debate for good. The Eleventh Circuit’s decision recognized the various courts’ different readings, and half-heartedly noted that under its “prior-precedent rule,” its nearly decade-old opinion joining the First, Fifth, and Seventh Circuits in construing the CFAA broadly would stand “unless and until it is overruled or undermined to the point of abrogation by the Supreme Court or by this court sitting en banc.” For those carefully reading between the lines, the court seemed doubtful that the broader interpretation favored in that circuit and in the First, Fifth, and Seventh Circuits remained viable, and appeared to subtly encourage Van Buren to seek further review from the Supreme Court.
Perhaps having read those particular tea leaves, Van Buren filed a petition in December 2019 for review before the Supreme Court, seeking to overturn his conviction and highlighting many of the foregoing issues. Specifically, Van Buren argued that the Eleventh Circuit’s broad interpretation of “exceeding authorized access” was improper, and that the narrow construction favored by the Second, Fourth, and Ninth Circuits should apply. The petition posited that in light of the long-standing split, “courts are just choosing sides,” and that the split would persist without clarification from the high court. Notably, the Supreme Court had previously been presented with the opportunity to weigh in on the scope of the CFAA, but declined to do so three years ago.
The government’s opposition, and SCOTUS’s decision
The government opposed Van Buren’s request for a review, arguing that the case was a “poor vehicle for resolving [the CFAA] issue.” Among other things, the government observed that Van Buren’s conviction for honest-services fraud had been vacated by the Eleventh Circuit, and that he would likely be retried. If he were convicted of that charge and sentenced concurrently, the government argued, “the practical significance of his challenge to his [CFAA] conviction would be reduced.”
The government also argued that Van Buren had overstated the depth of the circuit split, claiming that many of the cases cited in the petition for cert were “factbound” and “of limited relevance.” Finally, the government brushed off Van Buren’s concerns that the broader interpretation of the CFAA could criminalize ordinary computer use, pointing to a charging policy adopted by the Department of Justice in 2014 that arguably reduced the likelihood that garden-variety terms-of-service violations or other trivial conduct would result in criminal prosecution. Unsurprisingly, Van Buren’s reply brief hit back hard, cautioning that citizens should not simply trust that a non-binding charging policy will prevent government overreach, and pointedly noting that the government had not denied prosecuting alleged CFAA violations for terms-of-service violations prior to the implementation of the 2014 charging policy.
Clearly, SCOTUS agreed with at least some of Van Buren’s arguments. The Court granted his petition – no small feat, given that the Court typically only accepts 1-2% of the cases presented to it. The Court is set to hear arguments next term, which starts October 5, 2020.
Now that we know that SCOTUS will weigh in on a question that has been percolating for years, the big question is, of course, how the Court will rule. In his petition for cert, Van Buren’s counsel insisted that “[r]eading the statute more broadly would criminalize ordinary computer use throughout the country.” That argument could certainly gain a foothold with Justices concerned with the criminal justice implications of the CFAA’s language, which is obviously open to varying interpretations. Yet if SCOTUS interprets “exceeds authorized access” narrowly, as Van Buren is urging the Court to do, employers will likely lose an important tool in pursuing malicious former employees in a preferred forum. That concern is particularly relevant where an employee’s bad acts do not meet the definition of unlawful misappropriation under the DTSA, and an employer’s sole entrée into federal court is a CFAA claim.
In any event, unless something strange happens, we can expect a decision that clarifies the scope of CFAA once and for all by the end of June 2021. Whether we’ll be listening to a Justice reading the opinion from our homes while still social distancing, however, is another question…
Check back here for more developments as the Supreme Court looks to settle this long-standing debate.