Thread by @OrinKerr

NEW: DOJ has announced a new charging policy in CFAA cases. It's just current DOJ policy, not law, so it's only advisory. Still interesting. Part of it is just an update for the Van Buren era, but part of it seems to add some new limits.

🧵

justice.gov/opa/press-rele…

#N

First, the press release about the policy says that DOJ won't charge "good faith security research" but will charge "bad faith security research." But wait, what does that mean, you're wondering? The press release makes that a little murky, I think.
justice.gov/opa/pr/departm…

So you have to go beyond the press release to the actual charging policy. What it says seems pretty complicated, but here are the key parts, I think:

1) DOJ won't charge exceeding authorized access cases unless there's a violation of a code-based restriction.

2) On the other hand, DOJ does not appear to see that limit in "access without authorization" cases. (Which is tricky, as we don't know how DOJ sees the difference between the two!) Plus, DOJ thinks C&D letters are different -- that withdraws authorization, in DOJ's view.

3) Here's the specifics in the policy about what counts as "good-faith security research" that DOJ policy as of today won't charge.

The link of the standard is to a 356-page document from the DMCA rulemaking setting, and here's the cited page.
cdn.loc.gov/copyright/1201…

If I understand the context, one really big difference between the DMCA and CFAA setting is who owns the machine. The DMCA setting was that you can do stuff on your own machine; the CFAA setting is what you can do on *someone else's* machine.

The charging policy doesn't address civil liability, of course. So if you hack in to someone's computer with a good-faith security goal, etc., they could still sue you. But if I'm reading this correctly, DOJ is saying they won't charge you.

One thing that makes this interesting is that, over the years, a fairly high % of people charged with hacking claim a good-faith security goal. (Even when it's a preposterous claim, that's the public claim.).

This now becomes a claim defense counsel can make to DOJ if they find out DOJ is considering charging their clients; defense counsel can make the case to the AUSA that the client was acting in good faith and under the policy shouldn't be charged.

If DOJ disagrees, though, they can still charge the case even if DOJ is wrong. It's just a policy, not a law, so it's just something to guide prosecutorial discretion and doesn't create any rights in court.

Anyway, interesting and notable development post-Van-Buren.

Also note that, in the nature of these things, DOJ policies can have 3 different lives; (1) The intent of the drafters (what they were trying to do); (2) what the language suggests (what the language seems to say should not be charged); and (3 ) what an AUSA may think it means.

We can mostly comment on (2), and try to get our best sense of (1) from (2), but (3) is harder to predict in any given case. Still, noteworthy.

/end