Leech Tishman: Legal Services
Menu
  • Firm
    • About Us
    • Management
    • Diversity, Equity, and Inclusion
    • Careers
  • People
  • Capabilities
    • Practice Group
      • Business Restructuring & Insolvency
      • Construction
      • Corporate
      • Employment & Labor
      • Estates & Trusts
      • Intellectual Property
      • Litigation & Alternative Dispute Resolution
      • Real Estate
        • Leech Tishman Closings
    • Industries
      • Aviation & Aerospace
      • Cannabis
      • Emerging Cyber Technologies
      • Energy & Natural Resources
      • Entertainment & Sports
      • Healthcare
      • Hospitality
      • Life Sciences
  • Insights
    • All
    • Client Alerts
    • Firm News
    • Press
    • Podcasts
      • Cannabis LawTalk
      • Data Privacy LawTalk
    • Events
    • Resource Center
  • Locations
  • Payment
  • Contact

Connect

  • Facebook
  • Twitter
  • LinkedIn
Leech Tishman: Legal Services
  • Firm
    • About Us
    • Management
    • Diversity, Equity, and Inclusion
    • Careers
  • People
  • Capabilities
    • Practice Group
      • Business Restructuring & Insolvency
      • Construction
      • Corporate
      • Employment & Labor
      • Estates & Trusts
      • Intellectual Property
      • Litigation & Alternative Dispute Resolution
      • Real Estate
        • Leech Tishman Closings
    • Industries
      • Aviation & Aerospace
      • Cannabis
      • Emerging Cyber Technologies
      • Energy & Natural Resources
      • Entertainment & Sports
      • Healthcare
      • Hospitality
      • Life Sciences
  • Insights
    • All
    • Client Alerts
    • Firm News
    • Press
    • Podcasts
      • Cannabis LawTalk
      • Data Privacy LawTalk
    • Events
    • Resource Center
  • Locations
  • Payment
  • Contact
  • Search

“Who Goes There!”: U.S. Supreme Court Trims the Reach of the Computer Fraud and Abuse Act

Posted on June 18, 2021

By: James K. Paulick, Esq.

The U.S. Supreme Court trims the reach of the Computer Fraud and Abuse Act (CFAA) to now target only those who hack into computers or access information that which their credentials do not permit. Although a fascinating academic study of statutory interpretation, the decision may take the teeth out of a criminal statute that some businesses  have previously relied upon as a remedy if employees misuse the data to which they have access.

In Van Buren v. United States, 593 U.S. __ (2021), a police officer misused his access to law enforcement databases by pulling information on a license plate for an acquaintance in exchange for cash. (The individual’s plate that was searched was a fake entry created by the FBI as part of a sting operation on the Defendant Officer.) There was no dispute that the officer used his actual credentials and accessed information he would otherwise be permitted to access in his day-to-day job, but there was also no question that he was violating his organization’s policy that prohibited using the computer access for anything other than official police business.

Prior to Van Buren, several circuits had interpreted the CFAA statute to mean that “exceeds authorized access” is defined as “exceeding the access in the manner and instance and reason for which he or she was accessing,” while other circuits narrowly interpreted that phrase to mean “specifically to access files and information that your credentials do not permit.”

Taking a narrow, plain-meaning, statutory construction approach, the majority ruled that the “intentionally accesses a computer without authorization or exceeds authorized access” part of the statute is targeted toward those individuals who literally break into computers, or if they have valid access to a computer, break or hack into files and databases that their valid credentials do not have authorization to access.

In the business context, many employees have credentials that give them vast access to company databases containing extremely sensitive and private information on individuals and companies. Since the enactment of the CFAA, for many years  it was presumed that a company could leverage the CFAA with the help of law enforcement to punish those employees who stole information that they otherwise had the present ability to access through their credentials. This was based on the theory that in that instance these employees were “exceeding authorized access” by virtue of accessing that information for a corrupt reason or at least a reason that violated the company’s computer use policies.

With the Van Buren decision, companies will now have to rely on the patchwork of state statutes that may or may not fall to the same statutory interpretation. Companies are well advised to continue to protect themselves from misuse of their private and valuable electronically stored information by narrowly tailoring their credentialing and authorization such that every username and password should not be keys to the kingdom of company information. Right or wrong, the CFAA is no longer a big stick to play backup for businesses’ computer use policies.

For more information or assistance with reviewing data privacy and cybersecurity policies,  please contact James K. Paulick. Jim co-leads the Data Privacy Group, part of Leech Tishman’s Corporate Practice Group. He can be reached at 412.261.1600 or jpaulick@leechtishman.com.

Leech Tishman’s Facebook Page: https://www.facebook.com/leechtishman

Leech Tishman’s Twitter: https://twitter.com/LeechTishman

Leech Tishman’s Company Page on LinkedIn: https://www.linkedin.com/company/leech-tishman

Leech Tishman Fuscaldo & Lampl is a full-service law firm dedicated to assisting individuals, businesses, and institutions. Leech Tishman offers legal services in business restructuring & insolvency, corporate matters, employment & labor, estates & trusts, intellectual property, litigation & alternative dispute resolution, and real estate. In addition, the firm offers a wide range of legal services to clients in the aviation & aerospace, cannabis, construction, energy & natural resources, healthcare, and hospitality industries. Headquartered in Pittsburgh, PA, Leech Tishman also has offices in Chicago, Los Angeles, New York, Philadelphia, Sarasota, and Wilmington, DE.

Share on:

Insights

  • All
  • Client Alerts
  • Firm News
  • Press
  • Videos
  • Events

Categories

  • Bankruptcy Insights
  • Employment Blog
  • Family Law Videos
  • LaunchPad Blog

Archives

Connect

  • Facebook
  • Twitter
  • LinkedIn

Locations

  • Chicago, IL
  • Los Angeles, CA
  • New York, NY
  • Philadelphia, PA
  • Pittsburgh, PA
  • Sarasota, FL
  • WASHINGTON, D.C.
  • Wilmington, DE

© 2023 Leech Tishman Fuscaldo & Lampl LLC.
View our Terms of Use | Privacy Policy | Personnel Privacy Policy

Site by Imagebox