SCOTUS to Rule on Whether Unauthorized Access to Computer Data Is a Federal Crime

Van Buren v. United States, No. 19-783 (U.S. filed Dec. 18, 2019), is a case in which the Petitioner has asked the Supreme Court of the United States to rule on whether or not a person who is authorized to access information on a computer for certain purposes violates the Computer Fraud and Abuse Act if the same information is accessed for an unauthorized purpose. Van Buren requests that the Court reverse the judgment of the 11th Circuit that the Act should be interpreted broadly as covering access to information beyond stated use restrictions. The petitioner's brief points out that any access on a computer to information which violates a business's policies; a website's terms of service; or other restrictions would constitute a federal crime. Van Buren maintains that even if the government states it will not prosecute all violations of the Act, the Court should rule that section 1030 of the Act only concerns unauthorized computer hacking. Violations of private rules or state laws about the use of computer data should not be federal crimes.

While employed as a police officer, Van Buren looked up a license plate number in a database that he was authorized to use as part of his regular duties in exchange for $5,000.

The reply brief has been filed in this case, and it has been circulated to the Court for consideration at a conference. I will post about the decision when it is published.

Florida Court of Appeal rules passcode protected by Fifth Amendment

Yesterday, Judge Lambert issued an opinion, Garcia v. State, No. 5D19-590, 2020 Fla. App. LEXIS 12232 (Fla. Dist. Ct. App. Aug. 28,2020), ruling on the Petitioner’s request to quash an order requiring him to disclose the passcode for his smartphone on the grounds that it would be a violation of his Fifth Amendment privilege not to testify against himself. Garcia is alleged to attached a GPS tracker to his former girlfriend’s vehicle so he could monitor her whereabouts on his cell phone. He was charged with aggravated stalking. His smartphone was found outside the former girlfriend’s home.

The State filed a motion to compel which was granted by the trial court on the grounds that providing the passcode was non-testimonial.

The Florida Fifth District Court of Appeal agreed with Garcia that producing the passcode would require him to disclose the contents of his mind and provide the State with incriminating information that would be used against him. “Distilled to its essence, the revealing of the passcode is a verbal communication of the contents of one's mind.”. Id. at *8.

The Court also held that the foregone conclusion exception to the Fifth Amendment privilege should not apply in the sense that the existence of the passcode was a foregone conclusion akin to accounting paperwork prepared for a tax return. “To compel a defendant, such as Garcia, to disclose the passcode to his smartphone under this exception would, in our view, sound ’the death knell for a constitutional protection against compelled self-incrimination in the digital age.’” Id. at *12. (quoting Commonwealth v. Jones, 117 N.E.3d 702, 724 (Mass. 2019).

Unless the ownership of a smartphone was in question knowledge of a passcode would always be a foregone conclusion, and the State of Florida Court of Appeal declined to extend this exception which has only been affirmed in one case by the Supreme Court of the United States.

The question of whether compelling a passcode was a Fifth Amendment violation, and if providing a passcode was a protected testimonial communication was certified to the Supreme Court of the State of Florida.

District of Maryland Case with a Defendant Known Only By An IP Address

Last year, Judge Paula Xinis issued a decision, Malibu Media, LLC v. Doe, No. 8:19-cv-00576-PX, 2019 U.S. Dist. LEXIS 32986 (D. Md. Mar. 1, 2019), granting Malibu's motion requesting permission to initiate discovery to identify the Defendant. The Defendant had only been identified by an IP address assigned by an ISP on a particular date, and is alleged to have used BitTorrent to download copyrighted films.

The Court ordered the issuance of a subpoena to produce documents identifying the Doe subscriber. This production cannot be made until the Defendant received notice of the suit, and the Defendant is given 30 days to file a motion to quash the subpoena. The Defendant can file this motion without disclosing his or her identity to anyone except for the Court.

The identity of the Defendant will remain highly confidential, and must be redacted from public filings.