Is the Computer Fraud and Abuse Act Unconstitutionally Vague?

At the National Law Journal, attorney Nick Akerman (Dorsey & Whitney) contends that the Computer Fraud and Abuse Act (CFAA) indictment of Lori Drew (background about the case is here) is an appropriate interpretation of the statute:

While this may be the first prosecution under the CFAA for cyberbullying, the statute neatly fits the facts of this crime. Drew is charged with violating §§ 1030(a)(2)(C), (c)(2)(B)(2) of the CFAA, which make it a felony punishable up to five years imprisonment, if one “intentionally accesses a computer without authorization . . . , and thereby obtains . . . information from any protected computer if the conduct involved an interstate . . . communication” and “the offense was committed in furtherance of any . . . tortious act [in this case intentional infliction of emotional distress] in violation of the . . . laws . . . of any State.”

There is no question that the MySpace network is a “protected” computer as that term is defined by the statute. Indeed, “[e]very cell phone and cell tower is a ‘computer’ under this statute’s definition; so is every iPod, every wireless base station in the corner coffee shop, and many another gadget.” U.S. v. Mitra, 405 F.3d 492, 495 (8th Cir. 2005). There is also no question that a violation of MySpace’s TOS provides a valid predicate for proving that the defendant acted “without authorization.” What the commentators ignored in their critique of this indictment is that the “CFAA . . . is primarily a statute imposing limits on access and enhancing control by information providers.” EF Cultural Travel B.V. v. Zefer Corp., 318 F.3d 58, 63 (1st Cir. 2003). A company “can easily spell out explicitly what is forbidden.” Id. at 63. Thus, companies have the right to post what are in effect “No Trespassing” signs that can form the basis for a criminal prosecution.

If this interpretation of the law is correct, then the law is probably unconstitutionally vague. A vague law is one that either fails to provide the kind of notice that will enable ordinary people to understand what conduct it prohibits; or authorizes or encourages arbitrary and discriminatory enforcement. The CFAA, as construed by the prosecution in the Drew case, will probably be found vague because it authorizes or encourages arbitrary and discriminatory enforcement.

Suppose I put a notice on this post that says: “No attorneys may post a comment to this blog.” Suppose Nick Ackerman comes to this site, sees this post, and and writes a comment that is defamatory. Under his theory, he can be prosecuted for violating the CFAA. He has “trespassed” on this site. Moreover, if a blog has a policy that it will not tolerate “rude, uncivil, or off-topic comments,” then commenters who make such comments that are tortious (intentional infliction of emotional distress, public disclosure of private facts, false light, defamation, etc.) can be liable for a CFAA violation. Moreover, any use of a website that goes against whatever terms the operator of that site has set forth that constitutes a negligence tort is also criminal.

The problem here is that the CFAA’s applicability would be extremely broad — so broad that the cases likely to be prosecuted would be arbitrary. Since tort law is common law, and is very flexible, broad, and evolving, people would not have adequate notice about what conduct would be legal and not legal. There’s a reason why tort law is different from criminal law — we are willing to accept a lot more ambiguity and uncertainty in tort law than in criminal law, where the stakes involve potential imprisonment.

Moreover, Nick Akerman only focuses on the CFAA § 1030(c)(2)(B)(2), which makes it a felony to exceed authorized access if the offense was committed in furtherance of any tortious act.

The CFAA § 1020(a)(2)(C) makes it a criminal misdemeanor to “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer if the conduct involved an interstate or foreign communication.” If I’m interpreting this correctly (and I don’t purport to be an expert on the CFAA), under the Drew prosecutor’s interpretation of the CFAA, any time a person violates a website’s terms of service and access any information from the site, there’s a criminal violation. That means that if I post on this blog a notice that says: “No attorneys may access any other parts of this blog other than the front page,” and an attorney accesses any other page on my blog, then there’s a CFAA violation. Could the law possibly be this broad? I think it would require a narrowing interpretation in order to avoid problems of unconstitutional vagueness.

The CFAA strikes me as a very poorly drafted statute. The Drew indictment demonstrates the problems with the law. Either courts should fix the CFAA interpretively by narrowing its scope, or else strike it down as unconstitutionally vague. But what clearly cannot stand is for the law to be interpreted as the Drew prosecutor seeks to interpret it.

Hat tip: Dan Slater at the WSJ Blog

You may also like...

14 Responses

  1. Orin Kerr says:

    Great minds think alike. I raised just this argument in my NYU Law Review article on 1030. From the article”

    A contract-based approach to authorization may also render unauthorized access statutes void for vagueness on the ground that the statutes “fail to provide the kind of notice that will enable ordinary people to understand what conduct it prohibits.”272 Few users read the terms of service or terms of use of any of the computers they access, much less all of them, and many restrictions feature ambiguous

    terms that can be quite difficult to interpret.273 It is difficult, if not impossible, for a typical user to know for sure whether he is in compliance

    with all of the contractual restrictions regulating each of the computers he has accessed at any given time. Under the broad contractual theory of authorization, however, any violation of the terms of service or terms of use of any computer a person accesses violates the statutory prohibition on unauthorized access.

    78 NYU L. Rev. 1596 (2003)

    I also make an overbreadth argument, hinted at in your post, too.

  2. Correcting the Record on Scalia says:

    Not to belabor the point, but:

    Just last week during the course of Dan’s discussion (and totally unwarranted criticism of Justice Scalia, see my somewhat tardy retort there) about theories of interpretation, Dan suggested that Judges should construe laws based on their vision of “the good society.” Why on earth then does Dan not think that Judges should construe existing laws against the kind of acts that this despicable witch Lori Drew pulled? Does “the good society” sanction just letting her get away with it? One can, I suppose, go either way on the issue, but what this does show is that hairbrained schemes like allowing judges to construe laws based on their own moral codes leads to bizarre inconsistencies and political – if hard to explain under any political philosophy – outcomes.

  3. Bruce Boyden says:

    If this interpretation of the law is correct, then the law is probably unconstitutionally vague.

    I don’t think Akerman’s interpretation of the law is correct. It’s certainly not beyond question, as Akerman claims, that “a violation of MySpace’s TOS provides a valid predicate for proving that the defendant acted ‘without authorization.'” The quotes from the Zefer case were dicta — the defendant in that case was merely enjoined from acting in concert with another party’s breach of a (negotiated) confidentiality agreement. Violation of the terms of service may make use of the service “unauthorized” (by the contract), but it doesn’t retroactively make the *access* unauthorized.

    An analogy to real-world space might be useful. I have a contract to paint rooms in your house. The contract says I must use drop-cloths over all floors. I intentionally fail to use drop-cloths in one bedroom (because I’m cheap and only bought one), resulting in (unintended but completely foreseeable) damage. Am I guilty of criminal trespass? Of course not. You invited me into your house. Obviously, there was a contract governing what I was supposed to do after gaining access, but my failure to abide by the contract does not suddenly turn me into a trespasser.

  4. Correcting the Record on Scalia,

    So how would you interpret the law and the Constitution? To apply the law broadly based on the plain meaning of the law? What would you recommend for a legitimate way to interpret the Constitution as to what would be unconstitutionally vague or not?

    You strongly dislike my theory of interpretation, be it statutory or constitutional, but part of my argument is that interpretation based on a substantive view of the good society is inevitable and more honest. In my earlier post that you refer to, I suggested my theory of interpretation based on my argument that none of the so-called “legitimate” or “neutral” ways of interpretation were particularly compelling. I justified my theory based largely on the fact that everything else just doesn’t work. We can either accept the reality and embrace it, or try to cloak it, cover it up, or run away from it.

    Suppose you agree with my critique of existing methods of interpretation — that they involve a futile attempt to find some kind of process or method that is neutral and legitimate. What, then, would you recommend judges do if this is the case?

  5. Orin Kerr says:

    Correcting the Record on Scalia,

    I think Dan is being consistent. He wants an interpretation of 18 U.S.C. 1030 that would avoid bad results when the statute is applied across a range of cases, rather than just this one case.

  6. Correcting the Record says:

    Were I the Lori Drew Judge, I would examine the text of the statute and the meaning of the words chosen and make a reasonable judgment as to whether the Drew facts are covered by the statute. Based on that analysis, at this point I could not disagree with the notion that the law is vague or that it does not apply to this case. It seems doubtful that it does. But none of that is the point.

    First, I assume, without knowing for sure, that Dan would apply the “good society” mode of interpretation to statutes as well as the Constitution. I assume this because to apply the “good society” mode to the Constitution but not to statutes seems illogical; at least in the statutory context, where the Judge’s view of the “good society” is perverse, it can be corrected by the legislative process. Not so in the constitutional case. So there is no good reason to strictly construe a statute, but not the Constitution.

    Second, if the above-assumption is correct, it would make little sense to do what Orin seems to be implying that Dan would do: encourage a Judge to come up with a vision of how the “good society” would apply a given law and then apply that interpretation of the law across a “range of cases.” Why do so? The interpretation may further the interests of the “good society” in one context and then undermine it in another. Suppose the “good society” Judge finds a violation of federal law in this context by interpreting the law broadly, because Drew is repulsive. In the next case that comes before the same judge, a soldier’s mother who uncovered terrible conditions at an Army Hospital by accessing information on the internet comes before the same court. Why should a Judge guided by his vision of the “good society” apply the law broadly again? Indeed, why would a “good society” Judge ever apply a law in a manner that undermines his own goal? Based on this, I would suggest that the “good society” Judge cannot, if being true to his own theory, apply any rule across a “range of cases.”

    Thus such a judge would interpret each case on a case-by-case basis and never set down a fast rule. In that case the court simply substitutes a vague and inconsistent application of the statute for a vague statute. Those subject to the statute would be in the same boat as before – very confused.

    If I agreed with Dan’s theory that present methods of interpretation represent “a futile attempt to find some kind of process or method that is neutral and legitimate,” I would not suggest that every individual judge’s predilections should rule instead. That is rule by men, not law. Better than that would be majority rule and no application of the Constitution at all, for at least we’d have rule by the many, and not the few, and rule by law, and not men. But I would not suggest that either. Instead, the right choice is that Judges should do the best they can to interpret the Constitution, and the law, as it is written. There are volumes of book written as to why, and I do not think its been done better than Bork in “The Tempting of America,” and I would not attempt to substitute for that analysis here. I’ll simply keep my remarks simple and in keeping with an issue raised in the Dan post that started this exchange, the rights of minorities.

    There is no reason to believe that the rights of minorities are better protected by a “good society” judge than by an originalist. First, there is no reason to believe that the “good society” judge likes minorities, while many of the Constitution’s provisions, applied literally, inherently protect minorities – see, e.g., the Equal Protection Clause. Second, judges, as men and women like the rest of us, want to be liked and praised. If left to their own devices, they’ll tend to do what most of us would want them to do, that is, achieve popular outcomes. This tendency does not further the interests of minorities. Third, and last here (but not last in a complete list), while minorities are important, majorities are people too. When a “good society” Judge removes from the political process an issue not spoken for by the Constitution, the rights of majorities, not to mention minorities, are quashed. This often hurts both groups, and democracy more generally. See, e.g., the abortion issue.

  7. Jay Levitt says:

    I’m a non-lawyer, but I have a keen interest in the CFAA, so please forgive me if my questions have obvious answers. I’m a technology guy, and was part of the team at AOL that used the CFAA over a decade ago as a tool against spammers. I’m also an ardent civil libertarian. Puts me in a bit of a bind.

    As it was explained to me back then, the CFAA can be summed up as “If you lied just to get in the door, and we wouldn’t have let you in had you told the truth, you’re committing fraud”.

    It seems to me that the big question is “When does breach of contract turn into fraud?” Using Bruce’s example, simply failing to use dropcloths wouldn’t be fraud. But what if I signed the contract with absolutely no intention of using dropcloths – and you would never have hired me if you knew that? What if I signed it with absolutely no intention of doing any painting at all?

    Even that’s not quite analogous, though, because presumably my purpose in signing the contract was to get your money. Under the CFAA, it’s “access” that you’re lying for, not money. So, to really stretch the analogy, maybe you have a beach house, with a gorgeous view, and I made up the whole bit about being a painter just to get into your house for the day. Fraud yet?

    Or, for a better-yet-worse example, what if I claimed to be a orthodontist, and you signed a contract agreeing to pay me $50,000 to straighten your teeth – and I did the work, but wasn’t an orthodontist? (Let’s set aside licensing issues, practice-of-medicine, etc.) Is that fraud?

    Also, I see people talking about “trespassing”, but I believe that’s actually a different issue. In fact, we used “trespass to chattels” very successfully in a bunch of cases (see for examples). But I think the CFAA is about the “you lied so we’d let you in” part, not the “you used our servers” part.

    The real thing we want the CFAA to protect us from is, of course, hackers. I have my own server; the Terms of Service are “Jay can do anything he wants. Everyone else can read the blog.”

    Billy Badguy social-engineers my password from me, logs into my machine, claims he’s Jay Levitt, and starts editing my blog. Under the CFAA, that’s fraud. If he’d said he was Billy Badguy, he’d still be allowed to access the server – but only to read my blog, not edit it. So he hasn’t trespassed, but he has violated my rules, and that’s what makes it fraud. (If the rules were “anybody can edit Jay’s blog, anonymously”, it wouldn’t matter who he claimed he was.)

    How could the CFAA be drafted more narrowly, while still preserving the rights of computer owners to decide who does what with their computer?

  8. Correcting the Record,

    In my post about interpretation, which was primarily focused on constitutional interpretation, I argued that, as part of my theory, the Constitution must be made easier to amend, as this would at least confer some kind of legitimacy (after-the-fact legitimacy) to such interpretations:

    12. The solution seems to me to be to make the Constitution easier to amend (not too easy, but not nearly as difficult as it is now). A key factor in the process of changing the Constitution is that it should be slow — there needs to be some time for deliberation and cooling off so that the Constitution doesn’t just reflect the whims of the moment. If the Supreme Court decides something that strongly cuts against popular will, and it remains this way for a while, then the people should be able to change it. Supreme Court opinions are currently showstoppers. They shouldn’t be. Making the Constitution easier to amend will lessen the impact of Supreme Court decisions. The Court won’t be the final word. This also addresses (in part) the legitimacy problem. It may be that the quest for legitimacy can never be satisfactorily satisfied, but if the Constitution is easier to amend, the legitimacy of a judicial interpretation becomes less important. It also opens up the possibility for legitimacy to be conferred after-the-fact. If a Supreme Court decision stands the test of time (i.e., isn’t reversed via amendment), then it is at least something the people can live with. That’s not quite as pure a legitimacy as those seeking legitimacy would like, but it’s probably about as much legitimacy as one might get in a post-realist age.

    I also did not say that judges could just do absolutely anything they wanted to further the good society. I noted that there must be some kind of tethering, especially to text and original meaning, but any such tethering, by the nature of things, would not be very tight. So we could continue to pretend that somehow textualism and originalism really are binding in a meaningful way, but I think that the arguments attacking textualism and originalism have been very persuasive. This doesn’t mean that there is no merit to textualism or originalism — I think that debates that try to elevate one method of interpretation over another often oversell their preferred method, ignoring its weaknesses and ignoring the strengths in the alternatives. There is merit in many different methods of interpretation. But regardless of the method, they all will not achieve the kind of neutrality, legitimacy, or tethering that their proponents seek.

    In your response to my hypothetical, where I asked you to acknowledge the “futile attempt to find some kind of process or method that is neutral and legitimate,” you reply that “the right choice is that Judges should do the best they can to interpret the Constitution, and the law, as it is written.” But that just conflicts with the acknowledgment I asked you to make. My point was that text can’t really bind in the way textualists hope it can bind. I can tell that you disagree with this premise. But if you agreed with my premise that textualism and originalism aren’t adequately binding, then saying that judges should “do the best they can” to interpret the Constitution’s text isn’t really responsive.

    My theory, to try to simplify, was this:

    1. There are many methods of interpretation, and they all have some merits and some problems.

    2. None of these methods will provide the kind of legitimacy, neutrality, or tethering their proponents seek.

    3. Like it or not, substantive visions of the good will influence judicial decisions.

    4. Judges can either embrace the fact that they can’t escape a substantive vision, or they can try to conceal it, ignore it, or wish it away.

    5. The most honest approach is for judges to embrace the fact of #3.

    6. We want some countermajoritarianism in our government. But we have too much because the Constitution is too hard to amend. To alleviate some of the problems with judges having too strong a role, the Constitution should be easier to amend.

  9. Correcting to Record says:

    I’d like to respond more fully, but for the moment only have time to say that I did accept your hypo that all interpretive methods are “futile,” and suggested that pure democracy was better than “good society” judging, and the reasons why. Upon re-reading, I can see that my transition into the defense of originalism was inartful, but at that point I should have said that I was done with your hypo, and rejected its premise, for the following reason: [see bit on originalism is better]. With that understanding there is no illogic.

    But I would suggest that you ignored my hypo of the Army mother, and the point about protecting minorities, both of which seem quite sound to me and which undermine “good society” judging, even with some degree of “tethering” assumed.

  10. Correcting the Record,

    Part of our disagreement is this — I don’t see “good society” judging as a choice; you apparently do. I think that this is what judges do whether they acknowledge it or not. That doesn’t mean that it is pure and unconstrained “good society” judging, but it is unavoidable in my opinion. So the options I see on the table are to acknowledge and deal with it, which is what I devised my theory to do, or to try to reject or ignore this fact.

    There are certainly a number of practical limits on what judges can do with regard to “good society” judging. In particular, there are various norms in the legal community about what is appropriate for an interpretation and what isn’t. So there are many instances where a particular reading of the specific text will govern and few will quarrel with it. There are other interpretations that are generally accepted or else it would mean some very radical changes in the nature of our government (Ackerman’s point that the reconstruction amendments were not passed pursuant to proper constitutional procedure; the incorporation of the Bill of Rights; the legality of administrative agencies; the broad scope of Congress’s Commerce Clause power; etc.).

    For many questions, the norms of the legal community allow for a wide range of interpretations. These norms have not even resolved the issue of which method of interpretation is best — which is part of what inspired my post questioning why there is no stare decisis for methods of interpretation. My view of the reason, which I didn’t state in the post (I was posing a question), is (in part) that the legal community is too divided over this question for there to be a consensus. Even within particular interpretive method there are wide ranges where multiple and conflicting interpretations might apply. Not all textualists or originalists agree!

    So what I am trying to argue is this: The debate over interpretive method is often a futile one because (a) it’s been going on forever, with no side really winning or losing; (b) there’s a bit of truth on all sides of the debate, making it harder to find a clear winner; (c) no method of interpretation will give the kind of determinacy and legitimacy its proponents crave; and (d) as the recent Posner study illustrates, judicial views about the good society are influencing their decisions, no matter what their theory!

    So it’s not about choice — judges are already infusing their views about the good society into their decisionmaking, no matter what they say. This doesn’t mean that they are free to do whatever they want — they still, by and large, follow the norms of the legal community — but as I said above, these norms allow for quite a wide area of discretion.

    So for me, the real choice for judges is to: (1) continue to play the game, arguing in the same never-ending debate the same arguments and refutations, trumpeting that particular judge’s method of interpretation over all others, pretending that the judge is really bound by it, is neutral, and that it’s all legitimate; or (2) be honest and acknowledge one’s view of the good society and its influence; and then modify the system to allow for easier ways for society to reject judicial interpretations.

  11. Orin Kerr says:

    Part of our disagreement is this — I don’t see “good society” judging as a choice; you apparently do. I think that this is what judges do whether they acknowledge it or not.

    Dan, do you think this is what Judge Rymer was doing when you were one of her clerks?

  12. Orin,

    Judge Rymer was trying to follow precedent as narrowly and carefully as possible. But that precedent had to come from somewhere — at some point, some judge made a decision about the Constitution (whether the Supreme Court or another Ninth Circuit panel) — and that decision was based in part on the “good society.” So even by following precedent very closely, a judge is just following the “good society” vision of another.

    And when interpreting precedent, as when interpreting anything, there are always instances where a judge’s own ideology sneaks in, however much a judge tries to avoid that. Judge Rymer attempted to avoid that, and the attempt is certainly valiant, but it is inevitable that judicial interpretation is not neutral. Of course, there’s a difference between how much judges decide to depart from precedent, how brazenly they push the boundaries of existing interpretive norms, etc.

    Rymer’s approach in my opinion was to very closely follow precedent and to decide cases narrowly where possible. But this doesn’t eliminate discretion or the “good society” from the system. First, in many cases precedent doesn’t give us clear answers, so a judge has a lot of room to exercise discretion in interpreting. Second, in cases where precedent appears to provide plausible direction in a case (perhaps not crystal clear guidance about the outcome, but a decent indication of direction), following it just follows other previous interpretations based on the “good society.” You might counter that if all judges followed precedent very closely, then we’d be better off. That depends, of course, on whether the precedents being followed are any good. There are certainly pragmatic reasons why one might want to appear to follow precedent (to promote stability, continuity, etc.), but there may also be pragmatic reasons why the value of following precedent is outweighed by the value of revising a bad precedent. Following precedent just entrenches the existing precedents, which are based on “good society” visions that might be outmoded today. There’s no escape from the “good society” vision — either you follow a previous interpretation based on the “good society” or you depart from or stretch to some degree that interpretation.

    In other words, it’s turtles all the way down. Within the range of interpretive norms, judges can play boldly (like Judge Reinhardt) or narrowly (like Judge Rymer), but neither approach is neutral. Neither approach escapes from the fact that the interpretation is shaped by a view of the “good society.” The main difference is the pace of change — is it more dramatic or more Burkean?

  13. Correcting the Record says:


    I’m not sure we’re talking passed each other, I just think we disagree. While each method of interpretation may have flaws, and each practitioner of each method does have flaws, I don’t suggest throwing up our hands, following a hodge-podge of methods, and making it easier to amend the Constitution. Rather I suggest judges should try harder to follow the method I find least flawed. Different strokes.

    Finally – for me anyway, I have a brief due – I think it is important to note that while there is an argument that making it easier to amend the Constitution may ameliorate the “legitimacy” problem brought about by flawed interpretive methods, I think you should consider the impact of easier amendments on the constitutional values you originally cited as important – freedom and minority rights. First, consider the amendments that would pass right now if amendments could be passed on a simple majority (I recognize you did not suggest this standard) – the candidates that come to mind to me are the “Patriot Amendment,” the “Protection of Marriage Amendment,” the “Pledge of Allegiance Amendment,” the “English Only Amendment,” the “Gun Control Amendment,” etc. Whatever the merits of these amendments, they do not appear to me to be particularly freedom-enhancing. Second, under any conceivable amendment system, a majority would be required. Voting minorities, at least, would be the losers of every amendment enacted. This is unlikely to increase or maintain current protections of minority viewpoints and rights.

    Thus, solving a “legitimacy” crisis in this way would appear to create a worse problem, if these are the values we are seeking to further.

  14. Jay Levitt says:

    So, hey… about that, y’know, law… I’m curious to hear more.