Ninth Circuit: School, Employer Terms of Use Are Not the Law

On Tuesday, the United States Court of Appeals for the Ninth Circuit issued an en banc decision (.PDF) in United States v. Nosal, affirming a federal district court's dismissal of several counts of violating the Computer Fraud and Abuse Act (CFAA). At The Volokh Conspiracy, law professor Orin Kerr has been following this case closely for a few years, and in a recent post he highlights the broad importance of the Ninth Circuit's decision, which was authored by Chief Judge Alex Kozinski.

The decision holds that violating employee restrictions on workplace computer use is not criminalized by the CFAA. Why is this important for FIRE? Well, the CFAA contains a provision that makes it a federal crime, punishable for up to ten years imprisonment, to "exceed[] authorized access" on a computer. (18 U.S.C. § 1030(a)(4).) Lawyers and rights advocates have been worried that this would allow federal prosecutors to enforce the computer use policies of employers and colleges. 

As FIRE has pointed out before, university computer use policies often are not in compliance with the First Amendment, and many schools (for example, Lehigh University) maintain computer use policies that contribute to their red light rating. These policies are bad enough without students having to worry about being criminally prosecuted for sending, for example, "annoying" messages, which are actually banned at Lehigh. 

Thankfully, the Ninth Circuit has ruled that while unauthorized access is criminalized, unauthorized use is not. Thus, the CFAA has been narrowly interpreted and essentially criminalizes only what we think of as hacking. Violations of "acceptable use" policies by an otherwise authorized user are, according to the Ninth Circuit, not incorporated by the CFAA and not criminal. In fact, as Kerr notes, the Ninth Circuit took other federal circuits to task for reading the CFAA broadly, including the Eleventh Circuit, Fifth Circuit, and Seventh Circuit. The Ninth Circuit's opinion points out that "[t]hese courts looked only at the culpable behavior of the defendants before them, and failed to consider the effect on millions of ordinary citizens ... We therefore respectfully decline to follow our sister circuits and urge them to reconsider instead."

Amen! Hopefully the decision in Nosal will encourage other circuits to limit the CFAA along the lines of the Ninth Circuit. As Kerr points out, the Ninth Circuit has correctly found that the provision in question "has to be interpreted narrowly to avoid turning the CFAA into the statute that inadvertently criminalizes a tremendous scope of innocuous activity." College students should not be threatened with federal prosecution and imprisonment simply for violating their school's terms of use—especially considering how absurd or unconstitutional those terms might be.