In 1984, Congress passed the Computer Fraud and Abuse Act, a narrow statute to curb computer hacking, when hacking was so novel that criminal laws did not really address it. The act has been expanded repeatedly so it is one of America’s most extensive criminal laws.  The statute prohibits people from accessing computers and obtaining information in them either without authorization or beyond the authorization they have. The Justice Department has misguidedly urged that the law be broadly interpreted so that workers can be charged with a crime for using an office computer in a way that violates a company’s policy.  In an important 9-to-2 decision last week, the United States Court of Appeals for the Ninth Circuit sensibly rejected that approach. The full court interpreted the law narrowly, explaining that the government’s stance “would make criminals of large groups of people who would have little reason to suspect they are committing a federal crime,” when they engage in “minor dalliances” like “playing games, shopping or watching sports highlights.” The defendant in the case, David Nosal, and three colleagues left an executive recruiting firm to start a competing business. Before leaving the firm, Mr. Nosal’s colleagues, with valid computer passwords and access to proprietary information, took some of that data. The government indicted Mr. Nosal on many counts, including trade secret theft and violation of the computer abuse law for aiding his colleagues in exceeding their “authorized access” to the computers.  Mr. Nosal contended that his colleagues had permission to access the firm’s computers and the information contained there. He argued that the law was intended to criminalize computer hacking, not the misuse of data.  The appeals court was right to support his position. As Chief Judge Alex Kozinski wrote, the government’s overly broad interpretation of the statute would “transform whole categories of otherwise innocuous behavior” — like checking personal e-mail — “into federal crimes simply because a computer is involved.” It would wrongly turn an anti-hacker statute into one that made ordinary conduct illegal, with no indication that Congress intended to do so.
An appeals court rightly rejected an overly broad interpretation of a computer fraud law that would have made ordinary conduct at work illegal.