Transcripts For CSPAN Van Buren V. United States Oral Argume

Mr. Chief justice, made please the court, it is an antihacking statute. Seatingprohibits the that succeeding access. It also covers not only outside but inside hackers. The government seeks to transform the prong into a different prohibition. It covers obtaining information by a computer that predecessor is not entitled under the circumstances to obtain. It is no overstatement to say this would brand most americans criminals on a daily basis. Scenarios are limitless. Imagine a secretary whose employee handbook says her emailers them account may be used only for business purposes, or a person using a dating site using false information to obtain information about a lossal mates, or student. If a government is right, any of these people commits a federal crime. Any employee that use the zoom account over the next giving to connect with relatives would be subject to federal prosecutors. The main argument is that a single two letter word in the definition under exceeds authorized access. The term so demanded. That the userfies must be prohibited from obtaining information merely by a computer. It relieves the government of having to negate every possible alternative means by which the defendant might have obtained information at issue. The court should reverse. Im happy to take questions. Chief Justice Roberts mr. Versus united states, this is what we said authorization obtaining access without authorization and obtaining access with authorization, but then using that access and properly. You didnt mention that case in your opening brief. You did not mention it in your reply brief. I wonder what your answer to that quote is. My understanding is the court was given a summary of how the statute works. The question presented here was not presented there. Even the exceeds authorized reachedrong was not that i understand what the court is doing in the summary, similarly to be using the word improperly, and then moving right along. Chief Justice Roberts that is not what it says. This seems to me to go to the point at issue to second way you violate it is pretty obtaining access without authorization with then using that access improperly. I think my answer would simply be to look at the words of the statute. The definition of exceeds authorized access those not talk about improper use. It talks about obtaining information the accessor is not entitled to obtain. The definition of that term leaves out improper purposes because we know congress have those words in the very original provision of the statute and took them out in 1986. We know from other enactments we bluecited, page 19 of our brief, when Congress Wants to criminalize or otherwise granted improper use or on for unauthorized purposes, it does so expressive. Chief Justice Roberts just to make sure i have your interpretation correct, if a policy barring employees from accessing exceeds, and employee authorized access and would be covered if she goes on to facebook, but it would not be a violation if she used that access to look up customers Social Security numbers to sell them to a third party, right . Mr. Fisher im sure i follow, mr. Chief justice. My position is it would not aa to go on cf facebook. If you are asking about Social Security numbers, it would depend on whether the employee had access to that information. As we explained, if the employee used certain login credentials of somebody elses, for example, to get that information, that would be a violation of the statute. Chief Justice Roberts thank you, Justice Thomas. Justice thomas thank you, mr. Chief justice. Mr. Fischer, you gave a brief list of a parade of horribles. 11 this has been the rule for a while. Can you give us some actual examples of that happening someone violating this provision because of accessing xoom or Something Like that or facebook . Mr. Fisher Justice Thomas, not in the 11th circuit, but the papers discussed the drew case, which was before the ninth circuit. Somebody was prosecuted for misusing my there is a case involving ticketmaster that we site in the brief. More generally, Justice Thomas, i would also point you to two other things. The language of the statute has its own deterrent effect. For people that use the internet every day, they have to be aware of the criminal law, both on the criminal side, and remember, this statute has a single component. I think that is the critical thing as the court said in maranello and many other cases, you cannot construe a statute simply on the assumption the government will use it responsibly. If the government has withheld the full brunt of the prosecutor prosecutor told power, that does not enable the court to issue the statute on that promise. That is the critical argument with the governments point that i would point you to the committee for justice brief, which gives another example of not just every day facebook use, but political prosecutions, like the case in kelly last term and mcdonnell earlier. There is a persuasive case made on how any one of those prosecutions could be repackaged as a cfaa prosecution if the government were to win hear. Winhost Justice Thomas you seem to be making the point that if you have a level a clearance, but you access information that is level b, that would exceed authorization, but why couldnt you get the exact same thing on havether end you authority to access information, but you are limited that authorization is limited as to what you can do with it. Carexample, you work for a rental and you have gps, but rather than use it for a car that might be missing you might use it to follow a spouse, where in this case the use of information is a problem. I dont understand why you make the distinction between these or ways you can have or not have authorization. Mr. Fisher because of the language of the statute, Justice Thomas. The statute simply asks whether the user is entitled to obtain information and to use your car rental information, the user there is entitled to obtain gps information. It may be a breach of Company Policy in the case of the stalking example that the government gives in its brief, it might be a different crime, but the question in front of you here is whether it violates the as an active right now. Chief Justice Roberts Justice Breyer . Justice breyer the argument on the legislative history i am it just didnt because there was an earlier statute that did say clearly it is a crime to use your access for purposes to which such authorization does not extend, and that was changed but atpresent language, that time history says they did not need to make a substantive change. So, what do you respond to that . Mr. Fisher two things, Justice Breyer. The original provision was exceedingly narrow and apply to certain federal employees in certain information. When Congress Changes the law two years later in 1986, you are right that at one point in the Committee Reported talked about simply clarifying the statute, but in the other part of the Committee Report dealing with exactly the same words, what Congress Said is they had removed one of the murkier grounds for liability and refocused the statute on its principal object, so you have those crosscutting pieces of legislative history. Even the government, i would stress, does not argue that although the amendment is clarified, the government says it expanded the statute to go even beyond improper purposes to a violation of any stated use restriction. Nobody here is arguing the statute did not change in 1986. It is just a question of whether it expanded dramatically or took away that purpose language. As far the other thing i would stress about the legislative history is because this is a criminal case, we think it is improper, if not at the very least, very dangerous to rely on legislative history to resolve ambiguity. Instead, what you should look to is the rule of lenity, the principal term and kelly, maranello, where the court has resisted issuing ambiguity in federal criminal statutes to vastly enlarge the sweep of criminal liability. Justice breyer thank you. Chief Justice Roberts Justice Alito . Justice alito in this case we have received amicus briefs from organizations and individuals who are very concerned about what your interpretation would mean a mean for personal privacy. There are many Government Employees were given access to all sorts of personal information for use in performing their jobs, but if they use that for personal protect to make money, or carry out criminal activity, to harass people they dont like, they can do enormous damage. The same thing for people who work for private entities think of the person in the fraud detection section of a bank who has access to credit card numbers and uses that sell for a to personal profit. Do you think none of that was of concern when congress enacted that this statute . Mr. Fisher Justice Alito, with due respect, i dont think it was. What congress was concerned about is computer hacking, and that is up and down the legislative history. This new problem of hacking. The two things i would add to that because i understand the concern and there are powerful breeds about the policy question that you briefs about the policy question you raise, and if possible, Congress Might want to step in and regulate that or criminalize it to some effect, but the question is what does the statute you have in front of you right now do, and the problem with the governments view or the amicus briefs is there is no way to reach the government employee, or the financial employee that you are imagining without also reaching every other ordinary employee that violates an employee handbook. Justice alito let me ask you about that. You rely heavily on former judge ,aczynskis parade of horribles but in doing that you read the provisions of this section very, very broadly. Take the example of the person who lies about weight on a dating website. How would that be a violation of this statute . Mr. Fisher well, under the governments theory, it is a violation to use a website in violation of the terms of service. Justice alito the statute is obtained or alter information. How is that person obtaining or altering information . It is not the entering of the false information, Justice Alito. It is obtaining information on a dating website about a potential mate. You are obtaining information through a profile that is false and that it the terms of service of that website, and it falls squarely within the governments theory because you have gotten on that website with authorization, with your login credentials, because you are a single person, not married, etc. , and you have obtained information in violation of the stated use restrictions on that website. So, i dont see how the government gets out of the hypothetical. Justice alito thank you. Chief Justice Roberts Justice Sotomayor . Justice sotomayor counselor, i very much understand the concerns of my colleagues about , the illegaliefs cover, this would including the one addition here your client is a local Police Officer not your client, im arry yes, your client, local Police Officer who paid for information he got from a federal Computer System for personal reasons. But the fact that there isnt this federal crime doesnt mean that this conduct is not prosecuted in other ways, does it . Mr. Fisher no. Four vimplecom my client in this case was processed no, for example, my client in this case was prosecuted on another count that is pending on remand. The government talked about like the stalking example, miss obtaining health information, misuse of trade secrets, those could be prosecuted under different federal statutes, and if congress decided it could enact the proposal the department of justice has given it a couple times over the last several years to expand the cfaa in certain limited respects as i was trying to say earlier, Justice Sotomayor, the core of the problem is there is no foothold in the statute two inch the statute forward to cover the conduct in this case without also covering all kinds of violations of purposebased restrictions that could appear in service contracts, employee handbooks, syllabi, universities, or even oral dictates. Go back to the facts of this case and imagine mr. Van burens supervisor had told him do not do license plate searches until you finish your paperwork. Justice sotomayor counsel, are there targeted changes that can be made to limit the reach of the statute to exactly the fears that i think one of my colleagues expressed, of the kind of conduct we would think of as subjecting someone to punishment question mark i know, to punishment . I know confirms them, most statutes have a obtaining information and using it for financial gain. Mr. Fisher yes, Justice Sotomayor up and the government itself has sotomayor. The government itself has cited amendments. The cortical point i would make is that should come the critical point i would make is that should come from congress. Back to the statute, what about oral directives when you are on patrol, dont one license plates, i want you to be more efficient. There are any number of questions that would have to be addressed. In one ofsubsection the statutes, Justice Sotomayor. It does restrict federal employees use of information and parties. To third that is not part of the provision issue here. That would be a choice for congress to make and all of you think should be done in legislative basis. Chief Justice Roberts Justice Kagan . Fisher mr. Fisher, could you tell me again what you think so means . Mr. Fisher it means to the matter applied and what it means in the statute is you have obtained information by computer as opposed to some other means. Justice kagan could you parse that in a manner so described asks for a reference back. What are we referring back to on your theory . You are referring back to accessing a computer without authorization. We give an example of another federal statute on page two of our yellow briefs that uses so and this manner. It picks up on what was said earlier. The governments own hypothetical is the way this plays out the government worries about a federal contractor obtaining seller information from a salary database he does not have access to. What so does is it prohibits that person from defending himself from prosecution because mice thing i could have filed a foia request, called employees and asked them what they made, so i was entitled to obtain information. That is offlimits because of the word cell, and it helps the government. Your parade ofon horribles, one of the features is an employee checking instagram at work. How is that obtained nor altering for or altering information . Mr. Fisher you are literally obtaining the words or images out of instagram and it would violate the governments rule because the employee would be at least theoretically prohibited from using her work computer for personal reasons. So, checking instagram through your work computer would be an improper use and you would obtain information from the computer in the form of those pictures or words, or whatever they might be. Justice kagan thank you, mr. Fischer. Chief Justice Roberts Justice Gorsuch, gorsuch . Picking up on your Justice Gorsuch picking up on your parade of levels, could you link to the constitutional mr. Fisher thank you appeared i think there are two constitutional problems in one is a First Amendment problem with Certain Applications of the governments rule described in the amicus brief. Ondly there is the amicus rule that obtaining information you are not entitled on the circumstances to contain violates the statute. Vagueness impossible problem because either one of two things has to be correct. Either under the circumstances means literally every possible circumstance you could imagine, right down to someone orally telling you not to do that imagine a parent telling her teenager dont use instagram tonight until your homework is done, or dont use facebook to talk to your friends. The opportunity for prosecutorial discretion are probably broader than any has seenhe government if this government is right in literal terms. The only alternative is under the circumstances could somehow take some of the circumstances in and some out, but that is an indeterminate problem that i think violates the more the most basic fair notice principles of the criminal law. Justice gorsuch on the reverse parade of horribles, we have heard from the other side, i guess i am struggling to imagine how long the parade would be given the abundance of criminal laws available. If this did not cover that kind of conduct but there were troublesome forms of it like yours behavior in this case clients behavior in this case, misusing a police database, i assume there are ample state laws available that criminalized that conduct. Am i mistaken . Mr. Fisher no, this case comes from georgia, and georgia has a statute about hacking or. Isusing computer information the government, as we point out in our reply brief, the government gave a few hypotheticals in its brief and a most everyone of them is already addressed by some other provision of even the u. S. Code, let alone state law. Even, remember, my client himself has already lost his job and has other forms of punishment that have already been brought to bear. If congress decides somehow that is not enough and it wants the cfaa to also be available in situations like this, it could amend the statute, but i do not think there is anything like or a comparable problem on the other side in terms