Washington (CNN)The Supreme Court on Thursday narrowed the scope of a federal cybercrime law, holding that a policeman who improperly accessed a license plate database could not be charged under the law.
In a 6-3 majority opinion penned by Justice Amy Coney Barrett, the court held that Nathan Van Buren, a Georgia police officer, did not violate the nation’s top computer crime law when he searched a license plate database for non-official purposes.
Responding to a third party who offered to pay him to search the database — a person who turned out to be an FBI informant — Van Buren agreed, leading to what the US government alleged was a violation of the Computer Fraud and Abuse Act.
Barrett wrote that Van Buren’s conduct “plainly flouted” his department’s policy, which authorized him to obtain database information only for law enforcement purposes.
But, she said, the court had been asked whether he violated the CFAA, which “he did not,” she wrote. Barrett said the provision of the law at issue does not cover those “who have improper motives for obtaining information that is otherwise available to them.”
“To top it all off,” she wrote, the government’s expansive interpretation of the law “would attach criminal penalties to a breathtaking amount of commonplace computer activity.”
The court’s ruling adds definition to a long-running public debate over the breadth of the CFAA, and whether it applies to misconduct that stops short of breaking into a computer. In the past, the law has been invoked in cases involving website defacement and violations of terms of service, prompting digital rights groups to argue that it has been interpreted far too broadly.
Thursday’s ruling establishes a precedent that makes it harder to apply the CFAA in cases where an individual is authorized to access information on a computer but does so for “improper” reasons.
“Today’s decision is going to make it incumbent upon businesses and governments to be far more specific in their policies governing access to databases — not just about who is allowed to access particular databases, but about the specific purposes for which those individuals are and are not allowed to access that database,” said Steve Vladeck, CNN Supreme Court analyst and professor at the University of Texas School of Law.
“In the process, the court has made it a lot harder to punish those who misuse databases to which they generally have lawful access — and a lot more important for database owners to expressly prohibit uses of the data that aren’t specifically permitted,” he added.
Barrett’s majority opinion was joined by Justices Stephen Breyer, Sonia Sotomayor, Elena Kagan, Neil Gorsuch and Brett Kavanaugh. Justice Clarence Thomas dissented, joined by Justice Samuel Alito and Chief Justice John Roberts.
This story has been updated with additional information from the opinion.
