On Monday, the U.S. Supreme Court heard oral arguments in Van Buren v. United States. This case concerns the scope of the CFAA, a federal “anti-hacking” statute that makes it a crime to obtain information from any computer system without authorization. As originally passed back in the 1980s, the CFAA covers anyone who “exceeds authorized access” to a computer system. This means that technically an employee–or even a security researcher doing legitimate research–can be held criminally liable if they violate the owner’s terms of use.
The specific question before the Supreme Court is, “Whether a a person who is authorized to access information on a computer for certain purposes violates [the CFAA] if he accesses the same information for an unauthorized purpose.” A number of organizations, including the Electronic Frontier Foundation, have filed briefs in the case. The EFF’s brief specifically represents the interests of security researchers, and goes into some detail as to how the CFAA negatively impacts their work and harms the public.
The Court will issue its decision in the case sometime next year.