{"id":2005,"date":"2021-06-04T13:30:52","date_gmt":"2021-06-04T21:30:52","guid":{"rendered":"https:\/\/blog.mozilla.org\/netpolicy\/?p=2005"},"modified":"2021-06-04T13:37:56","modified_gmt":"2021-06-04T21:37:56","slug":"the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/netpolicy\/2021\/06\/04\/the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online\/","title":{"rendered":"The Van Buren decision is a strong step forward for public interest research online"},"content":{"rendered":"

In a victory for security research and other public interest work, yesterday the U.S Supreme Court held<\/a> that the Computer Fraud and Abuse Act\u2019s (CFAA) \u201cexceeding authorized access\u201d provision<\/a> should be narrowly interpreted and cannot be used to criminalize every single violation of a computer-use policy. This is encouraging news for journalists, bug bounty hunters, social science researchers, and many other practitioners who could legitimately access information in a myriad of ways but were at the risk of being prosecuted as criminals.<\/p>\n

As we stated in our joint amicus brief<\/a> to the Court in July 2020, over the years some federal circuit courts had interpreted the CFAA so broadly as to threaten important practices to protect the public, including research and disclosure of software vulnerabilities by those in the security community. The scope of such broad interpretation went beyond security management and has also been used to stifle<\/a> legitimate public interest research, such as looking into the advertising practices of online platforms, something Mozilla has pushed back<\/a> against in the past.<\/p>\n

In its ruling, the Supreme Court held that authorized access under the CFAA is not exceeded when information is accessed on a computer for a purpose that the system owner considers improper. For example, the ruling clarifies that employees would not violate the CFAA simply by using a work computer to check personal email if that is contrary to the company\u2019s computer use policies. The decision overrules some of the most expansive interpretations of the CFAA and makes it less likely that the law will be used to chill legitimate research and disclosures. The decision does, however, leave some open questions on the role of contractual limits in the CFAA that will likely have to be settled via litigation over the coming years.<\/p>\n

However, the net impact of the decision leaves the \u201cexceeding authorized access\u201d debate under the CFAA in a much better place than when it began and should be celebrated as a clear endorsement of the years of efforts by various digital rights organizations to limit its chilling effects with the goal of protecting public interest research, including in cybersecurity.<\/p>\n","protected":false},"excerpt":{"rendered":"

In a victory for security research and other public interest work, yesterday the U.S Supreme Court held that the Computer Fraud and Abuse Act\u2019s (CFAA) \u201cexceeding authorized access\u201d provision should … Read more<\/a><\/p>\n","protected":false},"author":1759,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[452984,283198,141519,46877],"tags":[69],"coauthors":[327272],"yoast_head":"\nThe Van Buren decision is a strong step forward for public interest research online - Open Policy & Advocacy<\/title>\n<meta name=\"description\" content=\"In a victory for security research and other public interest work, yesterday the U.S Supreme Court held that the Computer Fraud and Abuse Act\u2019s (CFAA) \u201cexceeding authorized access\u201d provision should be narrowly interpreted and cannot be used to criminalize every single violation of a computer-use policy.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/netpolicy\/2021\/06\/04\/the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Udbhav Tiwari\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/2021\/06\/04\/the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online\/\",\"url\":\"https:\/\/blog.mozilla.org\/netpolicy\/2021\/06\/04\/the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online\/\",\"name\":\"The Van Buren decision is a strong step forward for public interest research online - Open Policy & Advocacy\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/#website\"},\"datePublished\":\"2021-06-04T21:30:52+00:00\",\"dateModified\":\"2021-06-04T21:37:56+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/#\/schema\/person\/db15b43341560ad886176e33d6803b9e\"},\"description\":\"In a victory for security research and other public interest work, yesterday the U.S Supreme Court held that the Computer Fraud and Abuse Act\u2019s (CFAA) \u201cexceeding authorized access\u201d provision should be narrowly interpreted and cannot be used to criminalize every single violation of a computer-use policy.\",\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/2021\/06\/04\/the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/netpolicy\/2021\/06\/04\/the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/2021\/06\/04\/the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/netpolicy\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Van Buren decision is a strong step forward for public interest research online\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/netpolicy\/\",\"name\":\"Open Policy & Advocacy\",\"description\":\"Mozilla's official blog on open Internet policy initiatives and developments\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/netpolicy\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/#\/schema\/person\/db15b43341560ad886176e33d6803b9e\",\"name\":\"Udbhav Tiwari\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/netpolicy\/#\/schema\/person\/image\/f699f32e51f4160a4535df8e4fee7f12\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4f8624c8f8ea1e841eaa162ab2a2c0ce?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4f8624c8f8ea1e841eaa162ab2a2c0ce?s=96&d=mm&r=g\",\"caption\":\"Udbhav Tiwari\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Van Buren decision is a strong step forward for public interest research online - Open Policy & Advocacy","description":"In a victory for security research and other public interest work, yesterday the U.S Supreme Court held that the Computer Fraud and Abuse Act\u2019s (CFAA) \u201cexceeding authorized access\u201d provision should be narrowly interpreted and cannot be used to criminalize every single violation of a computer-use policy.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/netpolicy\/2021\/06\/04\/the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online\/","twitter_misc":{"Written by":"Udbhav Tiwari","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/netpolicy\/2021\/06\/04\/the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online\/","url":"https:\/\/blog.mozilla.org\/netpolicy\/2021\/06\/04\/the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online\/","name":"The Van Buren decision is a strong step forward for public interest research online - Open Policy & Advocacy","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/netpolicy\/#website"},"datePublished":"2021-06-04T21:30:52+00:00","dateModified":"2021-06-04T21:37:56+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/netpolicy\/#\/schema\/person\/db15b43341560ad886176e33d6803b9e"},"description":"In a victory for security research and other public interest work, yesterday the U.S Supreme Court held that the Computer Fraud and Abuse Act\u2019s (CFAA) \u201cexceeding authorized access\u201d provision should be narrowly interpreted and cannot be used to criminalize every single violation of a computer-use policy.","breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/netpolicy\/2021\/06\/04\/the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/netpolicy\/2021\/06\/04\/the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/netpolicy\/2021\/06\/04\/the-van-buren-decision-is-a-strong-step-forward-for-public-interest-research-online\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/netpolicy\/"},{"@type":"ListItem","position":2,"name":"The Van Buren decision is a strong step forward for public interest research online"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/netpolicy\/#website","url":"https:\/\/blog.mozilla.org\/netpolicy\/","name":"Open Policy & Advocacy","description":"Mozilla's official blog on open Internet policy initiatives and developments","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/netpolicy\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/netpolicy\/#\/schema\/person\/db15b43341560ad886176e33d6803b9e","name":"Udbhav Tiwari","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/netpolicy\/#\/schema\/person\/image\/f699f32e51f4160a4535df8e4fee7f12","url":"https:\/\/secure.gravatar.com\/avatar\/4f8624c8f8ea1e841eaa162ab2a2c0ce?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4f8624c8f8ea1e841eaa162ab2a2c0ce?s=96&d=mm&r=g","caption":"Udbhav Tiwari"}}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/posts\/2005"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/users\/1759"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/comments?post=2005"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/posts\/2005\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/media?parent=2005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/categories?post=2005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/tags?post=2005"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/netpolicy\/wp-json\/wp\/v2\/coauthors?post=2005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}