Thread by @ericgeller

The Supreme Court is now hearing oral arguments in Van Buren v. United States, a case about the proper scope of the Computer Fraud and Abuse Act.

Listen here: c-span.org/video/?477429-…

Read my preview here: politico.com/newsletters/we…

Justice Thomas asked Van Buren's lawyer if he has any real-world examples of the slippery slope argument that CFAA critics have been making in the 11th Circuit, where courts have followed the government's reading of the law for a while.

Van Buren's counsel says no, but references cases in other circuits, including one where someone was prosecuted for “misusing MySpace" and another one involving Ticketmaster.

Van Buren's lawyer adds that just because prosecutors haven't yet applied the CFAA in the most dramatic and far-reaching ways possible, “that doesn’t enable the Court to simply construe the statute on that promise.”

Van Buren's lawyer is Jeffrey Fisher from Stanford, btw.

Alito: Do you really think Congress wasn't worried about, say, bank employees selling credit card numbers when they enacted the CFAA?

Fisher: I don't think so. Congress was concerned about hacking, “and that’s up and down in the legislative history.”

Alito is pressing Fisher about how things like lying about weight on a dating service would violate CFAA.

Fisher says the CFAA violation comes not from inputting the lie, but from obtaining info (in the words of the statute) from potential matches based on the lie.

Sotomayor: I share my colleagues' concern about the misuse of sensitive data by people entrusted with it.

Fisher: Congress can pass other laws to prevent that.

Fisher: “The core of the problem is, there is no foothold in the statute to inch the statute forward to cover the conduct in this case without also covering all kinds of other violations" in terms of service, employee handbooks, college course syllabi, etc.

Sotomayor: Can you think of CFAA amendments that would address this?

Fisher: Yes, and the government cites some just as we do. But that should come from Congress, not the Court.

The justices keep asking Fisher to explain how the CFAA would criminalize seemingly innocuous things. Kagan just asked about checking Instagram at work.

Fisher says that would violate CFAA under the govt's reading b/c you're "obtaining" words & pictures from your Instagram feed.

At issue is what it means to criminalize "obtaining or altering information" from a computer system in a manner that violates the terms under which you are allowed to access the computer.

Gorsuch: If the CFAA doesn't cover these kinds of things, but there are other, more troublesome activities, like what you client did, are there other laws that could cover those offenses?

Fisher: Yes. Every offense that the government wants covered is covered by another law.

Barrett is pushing Fisher over his definition of "authorization," expressing skepticism of his idea that it's "an on/off switch." She asks why the Court shouldn't view authorization as being inherently dependent on the purpose of the access.

Fisher: We don’t think the CFAA treats authorization in that way. And given that other statutes do that, we think that’s evidence that Congress didn’t intend to do that here.

Fisher's closing argument is about the CFAA's ambiguity. He seems to think that enough justices see it that way that this will appeal to them.

"You cannot distinguish...hypotheticals [like Instagram] from the ones that the government wants to point at [as] the most troubling."

The lawyer for the govt comes out swinging, saying Fisher is trying to limit the CFAA so that it can’t prosecute anyone who ever has any valid access to the system they abuse. He says Fisher is relying on a “wild caricature of our position” w/ “invented cases” to scare SCOTUS.

Thomas: What’s your response to Fisher’s claim that CFAA is ambiguous?

Govt lawyer: I don’t think it is. “I think it clearly supports us and his reading is textually insupportable.”

Thomas wants to know why SCOTUS shouldn't apply the rule of lenity.

The government's lawyer is Eric Feigin, a deputy solicitor general at DOJ.

Breyer is asking why the CFAA can't be read, in the government's view, to criminalize checking Instagram at work?

Feigin: The key issue is whether the computer access is being used to do something that couldn't be done without it (e.g. stealing protected data).

Alito asks for clarity on what precisely the various terms in the CFAA mean, e.g. "authorization."

“I don’t really understand the potential scope of this statute without having an idea about exactly what all those terms mean.”

Alito: “What is this statute talking about when it speaks of information in the computer? All information that somebody obtains on the web is in the computer in a sense. I have a feeling that’s not what Congress was thinking about when it adopted this.”

Feigin: I think your concern arises from the way in which Fisher teed up this case for you. He’s suggesting that the only way to avoid the “parade of horribles” is to define those terms better. I think it's pretty clear that the CFAA doesn't cover the examples he cited.

Sotomayor summarizes the concern that several other justices have been hinting at: “You’re asking us to write definitions to narrow what could otherwise be viewed as a very broad statute, and dangerously vague.”

Kagan: Do you concede that, without the word "so" in the CFAA, you would lose this case?

Fisher: “I think it would be a much tougher case for us without the word ‘so,’ Your Honor.”

We are truly getting into the weeds here.

Gorsuch: This case seems to be the latest example of the government trying to broaden the scope of criminal laws in “contestable” ways. Why are you trying to do this for a state crime that’s prosecutable under state and perhaps other federal laws?

Gorsuch: Your argument about the scope of CFAA seems rather broad, “perhaps making a federal criminal of us all.”

Feigin: “We do think this is the correct reading of the specific, narrow portion of the language that is at issue here.”

(This should have said Feigin, not Fisher, obviously.)

https://twitter.com/ericgeller/status/1333463153884192771

Kavanaugh: Seems like CFAA only criminalizes taking info from system you’re not authorized to access. Why is that wrong?

Feigin: That would be like criminalizing stealing cash from a safe but not from cash register b/c you’re authorized to remove $ from register for your job.

Barrett is asking Feigin about the scope of the word "authorized" and why it should be so broad.

Feigin: “The word 'authorization' refers to specific, individualized permission, and there are going to be systems that” don’t require it, like public websites.

Feigin again criticizes Fisher's framing of CFAA's scope.

“He’s ... argued that unless you do what he wants, all of this other stuff’s going to be opened up. And we don’t have much case law on the other stuff, because nobody has ever made” sustained efforts to bring those cases.

Feigin: “To the extent we start to see cases like that, that’ll give courts, including this court if necessary, the opportunity to further articulate those limits.”

Fisher, in his rebuttal, says, "The best thing the government can say is, 'We haven’t brought a whole bunch of these prosecutions yet.' … They would be available under the government’s reading."

Fisher, picking up on Gorsuch's concern, notes the many cases "where the government offers a reading of federal statute that would sweep in everyday conduct .... What the court has done in every one of those cases is" require that any ambiguity be construed narrowly.

Arguments are over.

It certainly sounded like the justices were more skeptical of the government's argument than the Van Buren team's argument, re: the ambiguity in the wording of the CFAA.

But obviously that's no guarantee of how they'll rule.

Here's my story about this morning's SCOTUS arguments in Van Buren v. United States, where several justices sounded concerned about the government's interpretation of the U.S.'s main cybercrime law. politico.com/news/2020/11/3…