In a major 9-2 decision on Tuesday, the 9th U.S. Circuit Court of Appeals, San Francisco held that the government's interpretation of the Computer Fraud and Abuse Act was broader than intended. The court opined that if the government's interpretation was to be accepted then strict application would lead to the prosecution of millions of citizens for harmless activities. Judge Kozinski said the criminalization angle of the law, is applicable only to computer activity that “exceeds authorized access” and is not intended to address ‘how the information is used.'
The bench also observed that if the government's interpretation of the law was to be accepted then rather than remaining as a simple statute to thwart hacking, as intended by the scope of the law, it would become a “sweeping Internet-policing mandate” criminalizing any and all ‘unauthorized use of information' from a computer. Any ‘minor dalliances' at work like emailing, or playing games, social networking, or watching TV could then be charged as criminal activity.
The present ruling of the 9th Circuit Appeals Court in U.S. v. Nosal, 9th U.S. Circuit Court of Appeals, No. 10-10038, varies significantly from the broadened scope read into the statute by three other federal appeals courts. This increases the chances of the issue being pushed to the Supreme Court and the apex court sitting to define the scope of the law for guidance.
The accused in the case, David Nossal, was charged with convincing former colleagues to use their credentials and steal confidential client information from his ex-employer with the alleged intention of starting a rival business.
The former manager at Korn/Ferry International is yet to be tried for charges of mail fraud, theft of trade secrets and conspiracy. It is exactly here that the court narrowed the scope of the Computer Fraud Act and held that the law was to prevent hacking activity, while there were other laws to deal with ancillary criminal activities and intentions.
Dennis Riordan, a lawyer for Nosal, told the media that the ruling “leaves in place all the purposes of the anti-hacking statute, but it frees people from fearing they could be prosecuted for violating arcane provisions of employer policies.”
Nosal had made his appeal on the grounds that the CFAA counts against him do not survive as the 1984 law had been targeted at computer hackers and not at people who misuse legally obtained data.
