Fourth Circuit adopts narrow reading of the CFAA

We have discussed previously the tension between a wide and narrow reading of the CFAA - see Jeffrey's original take on Nosal - Ninth Circuit en banc adopts narrow reading of CFAA, and my analysis of the dissent - Why Nosal’s dissent is surprisingly persuasive.

Well, the Fourth Circuit has sided with the "narrow" camp, in WEC Carolina Energy Solutions v. Miller. Not surprisingly, it is another case of employee disloyalty that has been dressed up to be a federal hacking violation.  Essentially, Miller (or his assistant) downloaded documents while he was still employed and was authorized to access such information and then twenty days after his resignation used allegedly proprietary information (from the downloaded documents) in a presentation to customers for his new employer (a competitor of WEC). WEC eventually lost the contract and sued under the CFAA, alleging that the downloading of the documents was a violation of the CFAA because "'[u]nder WEC's policies they were not permitted to download confidential and proprietary information to a personal computer.' Thus, by doing so, they 'breache[d] their fiduciary duties to WEC' and via that breach, they either (1) lost all authorization to access the confidential information or (2) exceeded their authorization."

The court reviewed the panel decision in Nosal (which was later overturned en banc), and candidly called its interpretation of the CFAA a "non sequitur." Recall that a reading of the CFAA under the Nosal panel's interpretation would essentially criminalize employee violations of acceptable use policies. And lets not forget what the fight is really over - it is the plain text of the CFAA, which defines in pertinent part "exceeds authorized access" as:

to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.

The key word, as I have highlighted, is "so." Nosal defined so as "in that matter." The Fourth Circuit's responded:

To us, defining "so" as "in that manner" only elucidates our earlier conclusion that "exceeds authorized access" refers to obtaining or altering information beyond the limits of the employee's authorized access. It does not address the use of information after access. Indeed, the Ninth Circuit indicated as much in its en banc reversal, when it declined to hold that the interpretation of "so" as "in that manner" necessarily means employees can be liable for use-policy violations.  

The Fourth Circuit thus rejected the wide interpretation of "so," and applying the rule of lenity, held that "Congress has not clearly criminalized obtaining or altering information 'in a manner' that is not authorized. Rather, it has simply criminalized obtaining or altering information that an individual lacked authorization to obtain or alter."

The court went on to clearly reject the Seventh Circuit's interpretation of the CFAA as a "cessation-of-agency theory," in Citrin.  Namely, that the Seventh Circuit's interpretation is deficient because:

Such a rule would mean that any employee who checked the latest Facebook posting or sporting event scores in contravention of his employer's use policy would be subject to the instantaneous cessation of his agency and, as a result, would be left without any authorization to access his employer's computer systems.

The Fourth Circuit stated that in drafting the CFAA, Congress did not intend to legislate on the agency relationship and did not intend "the imposition of criminal penalties for such a frolic."

As Orin Kerr reported on the Volokh Conspiracy, subsequent to this decision the DOJ asked for an extension of time to file the petition for certiorari for the Nosal decision. That seems like a no-brainer to me. The government will need to craft an argument to sidestep this landmine, and I'm not sure they'll be able to do it.

I am highly persuaded by Judge Floyd's reasoning, and I absolutely agree that Congress never intended any interaction between agency theory and the CFAA. I agree because any other interpretation is illogical.  Congress was legislating computer intrusions (a.k.a. hacking) in 1986 (26 years ago) -and its intent in legislating the act is borne out by the record; it is further clarified when one considers documents such as the Hacker Manifesto (published Jan. 1986) which was all about breaking into systems, not use violations. Recall 1986 technology:

1986 wasn't the land of the "internets," the Googlemaker, or the MyFaceTube - it was a completely different technological standpoint. Which just reinforces a point I keep making - that the CFAA is anachronistic and should be revised; however, until it is, it should not be used as the sword of enforcement for violations of every and any use policy an entity can dream up.  Such an interpretation is not borne out by the text, the history, the intent, nor does it comport with the real function that the law was enacted to serve.

Read More

Fourth Circuit remands Vicky series restitution award

In a case concerning the Vicky child pornography series, the Fourth Circuit held that a child pornography victim is entitled to restitution in an amount "only for harm that he proximately caused." On remand, if the district court determines that proximate cause is established, they will then calculate "the quantum of loss attributable to [the defendant] for his participation in Vicky's exploitation."

The victim had suggested that general cause, rather than proximate cause, is the proper structure. This, the Fourth Circuit held, "would expand the availability of restitution for even the most attenuated damages."

At sentencing, the district court had ordered restitution of $305,219.86, which represents the total amount of Vicky's loss to date that has not already been paid by other defendants.

The case is United States v. Burgess, 2012 U.S. App. LEXIS 14152 (4th Cir. 2012). Many circuit courts have already dealt with this issue (read more here).

Read More

Fourth Circuit vacates CP transportation convictions as multiplicitous

The Fourth Circuit vacated 26 convictions for transporting child pornography as plain error of multiplicity in United States v. Buczkowski, 2011 U.S. App. LEXIS 25190 (4th Cir. 2011).

The defendant had been charged with possession and transportation of child pornography after a computer repairman found 27 images of child pornography on defendant's computer. The images were of his niece, some of which were pictures of the defendant and niece engaging in sexual acts. The defendant had been working for a military contractor in Iraq, and because he transported the images "using any means ... of foreign commerce", he was subject to the transportation charge.

At trial, he was convicted of 27 counts of transportation, but on appeal, he argued that the additional counts were multiplicitous. The court found that "[t]he central focus of the statute is the act of transporting, not the number of individual images transported." Therefore, only one count should have been charged. Because the defendant raised the issue for the first time on appeal, the court reviewed under plain-error, and found that the convictions should be vacated.

Read More

Fourth Circuit examines image requirement for probable cause, subjective "obscenity"

In United States v. Wellman, the Fourth Circuit held that an image of child pornography was not required to show probable cause and that a requirement of "obscenity" is not subjective.  663 F.3d 224 (4th Cir. 2011).

West Virginia's ICAC identified an IP address using Gnutella that had shared five images determined to be child pornography according to their hash values. Police tracked the IP address to Wellman (who had also been convicted of sexual abuse of a child in 1987 and was not registered as a sex offender as required by law).

Wellman argued that the warrant was defective because it did not contain the alleged images or descriptions of them. The court declined to require that the search warrant include an image to be valid. "While the inclusion of such material certainly would aid in the probable cause determination, we do not impose a fixed requirement or a bright-line rule, because law enforcement officers legitimately may choose to include a variety of information when submitting a search warrant application."

The defendant also argued that the "minors engaged in sexually explicit conduct were obscene" requirement placed a subjective knowledge requirement on the word "obscene." The court readily struck this down, however.

RELATED CASE: The Fifth Circuit recently held that probable cause existed where the only pre-search evidence of child pornography was knowledge of "partially nude" images of children. From that, an investigator testified that "people who collect child pornography collect child erotica as well." United States v. Gove, 2011 U.S. App. LEXIS 24175 (5th Cir. 2011).

Read More