Vagueness challenges to the computer fraud and abuse act

Minnesota Law Review

Volumn 94, Issue 5, 2010, Pages 1561-1587

  Kerr, Orin S ^a  

^a GEORGE WASHINGTON UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 79251630551     PISSN: 00265535     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Review

References (214)

1. See Counterfeit Access Device and Computer Fraud and Abuse Act of 1984, Pub. L. No. 98-473, § 2102 (a), 98 Stat. 2190, 2190-92.
2. Technically speaking, the Computer Fraud and Abuse Act was the 1986 amendment to 18 U. S. C. § 1030.
3. See Pub. L. No. 99-474, 100 Stat. 1213 (1986). However, it is common to refer to § 1030 as a whole as the Computer Fraud and Abuse Act. I adopt that convention here.
4. See infra Part I.
5. See infra Part I.
6. See 18 U. S. C. § 1030 (a) (1) - (3) (Supp. II 1985) (criminalizing certain computer misuse relating to national security, financial records, and government property).
7. See Orin S. Kerr, Cybercrime's Scope: Interpreting "Access" and "Authorization" in Computer Misuse Statutes, 78 N. Y. U. L. REV. 1596, 1616 (2003)
8. (reviewing 18 U. S. C. § 1030 provisions).
9. See id. ("The courts that have interpreted 'access' and 'without authorization' have offered a broad range of interpretations that run the gamut from quite narrow to extraordinarily broad.").
10. See, e.g., City of Chicago v. Morales, 527 U. S. 41, 56 (1999) (noting that a criminal statute may be invalidated if it "authorize[s]... arbitrary and discriminatory enforcement").
11. See infra Part II. A.
12. 259 F. R. D. 449 (C. D. Cal. 2009).
13. Id. at 457.
14. No. CR 08-00237 MHP, 2009 WL 981336 (N. D. Cal. Apr. 13, 2009).
15. *4.
16. See infra Part I.
17. See Kerr, supra note 6, at 1617 ("[S]everal recent decisions point toward remarkably expansive interpretations of unauthorized access.").
18. See infra Part II. B.
19. The Supreme Court's recent scrutiny of the "honest services" statute, 18 U. S. C. § 1346, may make such a future much more likely.
20. See Mark Sherman, Court Skeptical of Federal Anti-Fraud Law, DENV. POST, Dec. 8, 2009, http://www.denverpost.com/business/ci-13949538.
21. Comprehensive Crime Control Act of 1984, Pub. L. No. 98-473, 98 Stat. 1976.
22. See id. § 2102 (a), 98 Stat. at 2190.
23. 18 U. S. C. § 1030 (a) (1) - (3) (Supp. II 1985). For the sake of simplicity, I will refer to this language as simply a prohibition on "access without authorization" or "unauthorized access."
24. Id.
25. Id. § 1030 (a) (1).
26. Id. § 1030 (a) (2).
27. Id. § 1030 (a) (3).
28. Computer Fraud and Abuse Act of 1986, Pub. L. No. 99-474, 100 Stat. 1213.
29. 18 U. S. C. § 1030 (a) (4) - (6) (Supp. IV 1987).
30. Id. § 1030 (a) (4).
31. Id. § 1030 (a) (5).
32. Id. § 1030 (a) (6).
33. Id. § 1030 (e) (2).
34. Id.
35. See S. REP. No. 99-432, at 4 (1986)
36. reprinted in 1986 U. S. C. C. A. N. 2479, 2482 (detailing the preference of the Senate Judiciary Committee to limit federal jurisdiction over computer crime to instances involving a "compelling federal interest" or where "the crime itself is interstate in nature").
37. Violent Crime Control and Law Enforcement Act of 1994, Pub. L. No. 103-322, 108 Stat. 1796.
38. See generally William Jefferson Clinton, Remarks on Signing the Violent Crime Control and Law Enforcement Act of 1994, 20 U. DAYTON L. REV. 567 (1995);
39. Bill McCollum, The Struggle for Effective Anti-Crime Legislation-An Analysis of the Violent Crime Control and Law Enforcement Act of 1994, 20 U. DAYTON L. REV. 561 (1995).
40. Computer Abuse Amendments Act of 1994, Pub. L. No. 103-322, tit. XXIX, 108 Stat. 2097.
41. Id. § 290001 (b), 108 Stat. at 2097-98.
42. Id. § 290001 (d), 108 Stat. at 2098. At the time, the civil provision stated: Any person who suffers damage or loss by reason of a violation of the section, other than a violation of subsection (a) (5) (B), may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. Damages for violations of any subsection other than subsection (a) (5) (A) (ii) (II) (bb) or (a) (5) (B) (ii) (II) (bb) are limited to economic damages. No action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage.
43. U. S. C. § 1030 (g) (1994).
44. See Economic Espionage Act of 1996, Pub. L. No. 104-294, tit. II, 110 Stat. 3488, 3491.
45. See 18 U. S. C. § 1030 (a) (2) (Supp. II 1996).
46. See id. § 1030 (a) (2) (C).
47. See S. REP. No. 99-432, at 6 (1986)
48. reprinted in 1986 U. S. C. C. A. N. 2479, 2484 (noting that "obtaining information" in the statute includes "mere observation of the data").
49. 18 U. S. C. § 1030 (e) (8) (A) - (D).
50. Id. § 1030 (c) (2) (B) (i) - (iii).
51. Id. § 1030 (e) (2).
52. Compare 18 U. S. C. § 1030 (e) (2) (B) (Supp. IV 1987) (defining a "Federal interest" computer as one "which is one of two or more computers used in committing the offense, not all of which are located in the same State")
53. with 18 U. S. C. § 1030 (e) (2) (B) (Supp. II 1996) (defining a "protected computer" as one "which is used in interstate or foreign commerce or communication").
54. See infra notes 65-73 and accompanying text.
55. See Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act of 2001, Pub. L. No. 107-56, 115 Stat. 272.
56. Id. § 814, 115 Stat. at 382.
57. See 18 U. S. C. § 1030 (e) (2) (B) (Supp. II 2004).
58. Id.
59. See infra notes 60-64 and accompanying text.
60. See infra notes 60-65 and accompanying text.
61. 18 U. S. C. § 1030 (a) (5) (B) (v);
62. see § 814 (a) (4), 115 Stat. at 382.
63. Former Vice President Protection Act of 2008, Pub. L. No. 110-326, 122 Stat. 3560.
64. See id. § 203, 122 Stat. at 3561.
65. See id.
66. See id. § 204, 122 Stat. at 3561-62.
67. 18 U. S. C. A. § 1030 (e) (2) (West 2000 &Supp. 2009).
68. Id.
69. Compare 18 U. S. C. § 1030 (e) (2) (B) (2006)
70. with 18 U. S. C. A. § 1030 (e) (2) (West 2000 & Supp. 2009) (emphasis added).
71. See United States v. Chesney, 86 F.3d 564, 571 (6th Cir. 1996).
72. Gonzales v. Raich, 545 U. S. 1, 17 (2005)
73. (quoting Perez v. United States, 402 U. S. 146, 152 (1971)).
74. See id.
75. See id. at 18-19.
76. 18 U. S. C. A. § 1030 (e) (2) (West 2000 & Supp. 2009).
77. See id.
78. See id.
79. See id.
80. 18 U. S. C. A. § 1030 (e) (1) defines a "computer" as: an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device[.]
81. See, e.g., Press Release, U. S. Attorney's Office, Dist. of Mass., Former Inmate Sentenced for Hacking Prison Computer (Dec. 22, 2009), available at http://www.cybercrime.govt/janoskosent.pdf (illustrating how a person hacking one prison computer can have a significant effect on the lives of hundreds of government officials outside prison walls).
82. Cf. United States v. Jeronimo-Bautista, 425 F.3d 1266, 1273-74 (10th Cir. 2005).
83. See 18 U. S. C. A. § 1030 (e) (1).
84. Cf. United States v. Mitra, 405 F.3d 492, 496 (7th Cir. 2005).
85. See 18 U. S. C. A. § 1030 (a) (2).
86. See Kerr, supra note 6, at 1597.
87. See id. at 1619-21.
88. See id. at 1622-24.
89. See discussion infra Part II. A.
90. See discussion infra Part II. A.
91. See discussion infra Part II. B.
92. 259 F. R. D. 449, 451 (C. D. Cal. 2009).
93. * 4 (N. D. Cal. Apr. 13, 2009).
94. United States v. Williams, 128 S. Ct. 1830, 1845 (2008).
95. See City of Chicago v. Morales, 527 U. S. 41, 56 (1999).
96. Giaccio v. Pennsylvania, 382 U. S. 399, 402 (1966).
97. Id. at 402-03.
98. See Wainwright v. Stone, 414 U. S. 21, 22-23 (1973) ("For the purpose of determining whether a state statute is too vague and indefinite to constitute valid legislation 'we must take the statute as though it read precisely as the highest court of the State has interpreted it.'").
99. See id.
100. See id.
101. See id.
102. See, e.g., City of Chicago v. Morales, 527 U. S. 41, 64, 92, 112 (1999) (invalidating a Chicago ordinance under a broad reading while the dissent would have upheld the statute under a narrow reading).
103. Coates v. City of Cincinnati, 402 U. S. 611, 616 (1971).
104. See id. at 611 (quoting CINCINNATI, OHIO, Code § 901-L6 (1956)).
105. Id. at 612 (quoting City of Cincinnati v. Coates, 255 N. E.2d 247, 249 (Ohio 1970)).
106. Id. at 614
107. (quoting Connally v. Gen. Constr. Co., 269 U. S. 385, 391 (1926)).
108. See id.
109. See, e.g., Kolender v. Lawson, 461 U. S. 352, 357 (1983).
110. Id. at 358.
111. Id. at 357.
112. See id. at 358.
113. See Shuttlesworth v. City of Birmingham, 382 U. S. 87, 90 (1965).
114. Id.
115. See id.
116. Compare Kolender, 461 U. S. at 358
117. with Shuttles Worth, 382 U. S. at 90.
118. Compare Kolender, 461 U. S. at 358
119. with Shuttlesworth, 382 U. S. at 90.
120. Kolender, 461 U. S. at 358.
121. Id.
122. Id.
123. Id.
124. Id.
125. See Giaccio v. Pennsylvania, 382 U. S. 399, 402-03 (1966).
126. See Kolender, 461 U. S. at 358.
127. See United States v. Drew, 259 F. R. D. 449, 458 (C. D. Cal. 2009) (noting "there is a considerable amount of controversy" as to the meaning of "without authorization");
128. see Kerr, supra note 6, at 1622-24 (discussing ambiguities in the concept of authorization to access computers).
129. See Kerr, supra note 6, at 1630 ("Although courts have struggled to distinguish between these two phrases, prohibitions against exceeding authorization appear to reflect concerns that users with some rights to access a computer network could otherwise use those limited rights as an absolute defense to further computer misuse.").
130. See id. at 1637-40 (describing cases in which two parties are "bound by a contract that implicitly or explicitly regulates access to a computer, and one side uses the computer in a way that arguably breaches the contract").
131. See id. at 1640-42 (discussing the courts' difficulties with interpreting "unauthorized access").
132. Id.
133. See Kerr, supra note 6, at 1598-99.
134. See generally id. at 1624-32 (discussing the conflicting definitions of "access" and "authorization" in case law).
135. Smith v. Goguen, 415 U. S. 566, 574 (1974).
136. See A. HUGH SCOTT & KATHLEEN BURDETTE SHIELDS, COMPUTER AND INTELLECTUAL PROPERTY CRIME: FEDERAL AND STATE LAW 4-3 (Supp. 2006) ("Congress has steadily increased the breadth of the coverage of the CFAA.... Thus, invasion of or damage to any computer connected to the Internet, or to the information on those computers... is now a federal crime under 18 U. S. C. § 1030.").
137. See id. at 4-25 to -26.
138. See id. at 4-16 ("[T]he notion of 'accessing' a computer is central to the CFAA....").
139. See id. at 4-3 ("The original 1984 version of the statute was limited to protecting federal government computers, defense or foreign relations information of the United States, and information of a financial institution or credit reporting agency.").
140. See Kerr, supra note 6, at 1641 (describing the development of computer technology since the 1970s).
141. See 18 U. S. C. A. § 1030 (e) (2) (B) (West 2000 & Supp. 2009) ("[T]he term 'protected computer' means a computer... which is used in or affecting interstate or foreign commerce or communication....").
142. Id. § 1030 (e) (1) ("[T]he term 'computer' means an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device....").
143. Id. ("[T]he term 'computer'... does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device...."). Perhaps future courts will construe "other similar device" broadly to exempt common items that have been computerized, but as of now we have no sign that courts will take that approach.
144. See, e.g., United States v. Mitra, 405 F.3d 492, 495 (7th Cir. 2005) (adopting a broad interpretation of § 1030 (e) (1), limited only by its explicit exceptions).
145. 18 U. S. C. A. § 1030 (e) (1).
146. Id. § 1030 (a) (2) (C) ("Whoever... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains... information from any protected computer... shall be punished....").
147. Scott & Shields, supra note 121, at 4-25 (explaining that the broad definition of protected computer combined with a global Internet means that home computers with online access fall within the CFAA's reach).
148. See United States v. Drew, 259 F. R. D. 449 (C. D. Cal. 2009).
149. See, e.g., Times Topics: Lori Drew, http://topics.nytimes.com/top/ reference/timestopics/people/d/lori-drew/index.html?scp=1-spot&sq=Lori%20 Drew&st=cse (last visited Apr. 12, 2010).
150. Drew, 259 F. R. D. at 452.
151. Id.
152. Christopher Maag, A Hoax Turned Fatal Draws Anger But No Charges, N. Y. TIMES, Nov. 28, 2007, at A23 ("In a report filed with the Sheriff's Department, Lori Drew said she created the MySpace profile of 'Josh Evans' to win Megan's trust and learn how Megan felt about her daughter.").
153. Drew, 259 F. R. D. at 452.
154. Id.
155. Id.
156. Indictment at 6, Drew, 259 F. R. D. 449 (No. 08-00582), 2008 WL 2078622.
157. Drew, 259 F. R. D. at 454.
158. Id.
159. Indictment, supra note 140, at 6-7.
160. Id. at 9.
161. See Notice of Motion; Motion to Dismiss Indictment for Vagueness, Drew, 259 F. R. D. 449 (No. 08-00582), 2008 WL 2848959.
162. Id.
163. See Supplement to Rule 29 Motion at 4, Drew, 259 F. R. D. 449 (No. 08-00582), 2008 WL 5381025 ("If a person or business actually grants permission for the act, conditioned on some understanding that turns out to be false, then the act is still authorized for the purposes of criminal law.").
164. Drew, 259 F. R. D. at 464 ("[I]f a website's terms of service controls what is 'authorized' and what is 'exceeding authorization'... section 1030 (a) (2) (C) would be unacceptably vague because it is unclear whether any or all violations of terms of service will render the access unauthorized, or whether only certain ones will.");
165. see Reply to Government Response to Defense Rule 29 at 5-6, Drew, 259 F. R. D. 449 (No. 08-00582)
166. WL 54313 (outlining the defense's arguments regarding the fair warning canons).
167. Drew, 259 F. R. D. at 464-65.
168. Id. at 468.
169. See id. at 459-60.
170. Id. at 462 ("[T]he vast majority of the courts (that have considered the issue) have held that a website's terms of service/use cannot define what is (and/or is not) authorized access vis-a-vis that website.").
171. Id. at 465 ("[B]y utilizing violations of the terms of service as the basis for the section 1030 (a) (2) (C) crime, that approach makes the website owner-in essence-the party who ultimately defines the criminal conduct. This will lead to further vagueness problems.").
172. See id. at 463-65 (noting the ability of website owners to "unilaterally amend... the terms with minimal notice to users" and stating that statutes that do not define the criminal offense with sufficient definiteness encourage discriminatory enforcement).
173. Id. at 466.
174. Id. at 467 (quoting Kolender v. Lawson, 461 U. S. 352, 358 (1983)) (citation omitted).
175. Id. at 463.
176. See generally Jessica R. Friedman & Gerry A. Fifer, Website Development and Hosting Agreements for Terms of Service, in REPRESENTING THE NEW MEDIA COMPANY 2000, at 467, 476-81 (2000) (PLI Patents, Copyrights, Trademarks, & Literary Property, Course Handbook Series No. 587, 2000) (providing website owners with an overview of points to consider in drafting a Terms of Service agreement).
177. See Drew, 259 F. R. D. at 466.
178. Id.
179. The Terms of Service require that "all registration information you submit is truthful and accurate." Id. at 454.
180. Jessica Bennett, Is Age Just a Number?, NEWSWEEK, Nov. 5, 2007, http://www.newsweek.com/id/62330 ("According to public documents obtained by NEWSWEEK-including professional license information, voter registration and utility and telephone service applications-Anderson is five years older than he claims.").
181. See Jacob Rogers, A Passive Approach to Regulation of Virtual Worlds, 76 GEO. WASH. L. REV. 405, 420 (2008) ("The typical consumer does not read a terms-of-service contract because the costs of doing so (primarily the time spent reading) outweigh the benefits, which are most often essentially zero."). The forewoman of the Lori Drew jury appears to be a rare exception. When she spoke to the press after the trial, she expressed the view that she "always" read Terms of Service and that a person "absolutely" should be held liable if they are "lazy" and do not read the entire agreement.
182. See Kim Zetter, Jurors Wanted To Convict Lori Drew of Felonies, but Lacked Evidence, WIRED, Dec. 1, 2008, http://www.wired.com/threatlevel/2008/12/ jurors-wanted-t/.
183. See Ashley Surdin, Woman Guilty of Minor Charges for My Space Hoax, WASH. POST, Nov. 27, 2008, at A10.
184. See, e.g., Shamrock Foods Co. v. Gast, 535 F. Supp. 2d 962, 964-65 (D. Ariz. 2008) (detailing the split among courts over the meaning of the word "authorization" in the CFAA).
185. * 3 (N. D. Cal. Apr. 13, 2009).
186. *1.
187. Id.
188. Id.
189. Id.
190. Superseding Indictment at 2-3, Nosal, 2009 WL 981336 (No. CR 08-00237 MHP).
191. * 2.
192. 18 U. S. C. A. § 1030 (a) (4) (West 2000 & Supp. 2009).
193. Id. ("Whoever... knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value... shall be punished....").
194. See, e.g., Int'l Airport Ctrs., L. L. C. v. Citrin, 440 F.3d 418, 420-21 (7th Cir. 2006) (distinguishing this case in what appears to be dicta by finding that "Citrin's breach of his duty of loyalty terminated his agency relationship... and with it his authority to access the laptop, because the only basis of his authority had been that relationship");
195. see also Katherine Mesenbring Field, Agency, Code, or Contract: Determining Employees' Authorization Under the Computer Fraud and Abuse Act, 107 MICH. L. REV. 819, 823-24 (2009) (outlining the agency-based interpretation of authorization and the Seventh Circuit's adoption of it in Citrin).
196. See Kerr, supra note 6, at 1632-37 (describing several cases in which employees exceeded authorized use by using "their employers' computers in ways that exceeded the scope of their employment").
197. *5.
198. See id.
199. *5.
200. * 10 (S. D. Tex. Feb. 3, 2009);
201. Black & Decker (US), Inc. v. Smith, 568 F. Supp. 2d 929, 933-34 (W. D. Tenn. 2008);
202. Diamond Power Int'l, Inc. v. Davidson, 540 F. Supp. 2d 1322, 1341-43 (N. D. Ga. 2007);
203. B & B Microscopes v. Armogida, 532 F. Supp. 2d 744, 758 (W. D. Pa. 2007);
204. * 2-4 (E. D. Pa. July 13, 2007);
205. * 5 (M. D. Fla. Aug. 1, 2006);
206. Int'l Ass'n of Machinists & Aerospace Workers v. Werner-Masuda, 390 F. Supp. 2d 479, 499 (D. Md. 2005).
207. *4.
208. *5-6.
209. Id.
210. 581 F.3d 1127, 1132-35 (9th Cir. 2009).
211. See 18 U. S. C. A. § 1030 (e) (2) (West 2000 & Supp. 2009) (defining "protected computer").
212. See supra note 123 and accompanying text.
213. Kolender v. Lawson, 461 U. S. 352, 357-58 (1983)
214. (citing Smith v. Goguen, 415 U. S. 566, 574 (1974)).