The Ninth Circuit en banc issued an opinion  in the case of United States v. Nosal (Download US v Nosal 9th Cir 2012-04-10).  It is not often that we see opinions that interpret section 1030, the Computer Fraud and Abuse Act.  But it is also likely that this will be a hot area of the law as Hon. Kozinski, who authored the opinion in this case, begins with the line "[c]omputers have become an indispensable part of our daily lives."

The government charged the defendant with violations of 18 U.S.C.s 1030(a)(4) for allegedly "aiding and abetting" a companies employees "in 'exceed[ing their] authorized access' with intent to defraud." The trial court dismissed certain counts and the government appealed.  In affirming the trial court's dismissal, the 9th Circuit states, "[b]asing criminal liability on violations of private computer use polices can transform whole categories of otherwise innocuous behavior into federal crimes simply because a computer is involved."  The court finds that "[t]herefore, we hold that 'exceeds authorized access' in the CFAA is limited to violations of restrictions on access to information, and not restrictions on its use."

The Ninth Circuit makes a point of noting the jurisdictional split that exists with respect to this issue.  The court states,

"[w]e therefore respectfully decline to follow our sister circuits and urge them to reconsider instead. For our part, we continue to follow in the path blazed by Brekka, 581 F.3d 1127, and the growing number of courts that have reached the same conclusion. These courts recognize that the plain language of the CFAA 'target[s] the unauthorized procurement or alteration of information, not its misuse or misappropriation.'"

The decision uses the Rule of Lenity and sends word to Congress that if it "wants to incorporate misappropriation liability into the CFAA, it must speak more clearly."

The court rejects an argument we often hear from the government – trust us – we won't prosecute cases that should not be prosecuted.  The court noted that most individuals are unaware of the terms of service agreements of internet providers including one major company that until recently "forbade minors from using its services."  The court stated, "we shouldn’t have to live at the mercy of our local prosecutor. . . And it’s not clear we can trust the government when a tempting target comes along."(citations omitted).

(esp)(hat tip to Evan Jenness)