Does OA Owe Amy Coney Barrett An Apology?

Transcript

This transcript was generated automatically and may contain errors — the audio is the record.

0:00:04 Jenessa: What do I think Congress meant? And what Congress meant might have been dumb as shit.

0:00:18 Thomas: I think she doesn't realize that that's just restating the problem if you think authorization has a necessary purpose in it. Hello and welcome to Opening Arguments. This is episode 1225. I'm your host, Thomas Smith. It's Monday, and lately that has meant a deep dive with Jenessa. We've been trying to do the old -fashioned deep dive that isn't necessarily the here -and -now, everyday horror of politics. And I've been really enjoying it. I hope you have as well. Well, I got to say, this week I questioned whether or not I should maybe preempt that because I'm sure all of you, I'm just really, really upset about ICE murdering a mother in cold blood. I was very tempted to just honestly just do commentary myself because I am so upset about it. But in the end, I thought, why don't we keep the Monday format the Monday Format precisely because of what it's meant to do and that it's met to get back to why so many of us love to learn about the law and talk about the law and discuss the arguments and not only that we're for sure going to be doing plenty about the killing of Renee Good and horrible legal takes about that situation and ice in general. So there's going to plenty of that. So in the end I've decided to air something Jenessa and I recorded off the heels of the previous Van Buren episode that got so much fun interaction and a lot of people I think had as good a time as I did trying to break that one down. So, I hope you have listened to that one. It's probably pretty necessary to have listened to it. I'll try to sum up a little bit here just in case, but you probably should go back and listen to that One. That was, of course, Van Buren v. U .S. and Amy Coney Barrett's So -So Textualism. That's OA 1220. So, after we did that, I became sort of obsessed with it for a bit because it really seemed like Jenessa and I maybe disagreed and I also felt like I couldn't quite grasp all the arguments that were going on. You know me, I like to to make sure I understand everything as much as I possibly can. And so I got hooked on it and I read a bunch about it and I checked out a bunch of other stuff I'm going to talk about. And I came to a surprising for me conclusion that I wanted to run by Jenessa. Meanwhile, Jenessa was also doing some amount of research and had a bunch other tie -ins and some other topics to bring along the way. So we thought it would be totally worth it doing a follow -up to discuss that case for a bit and also bring in some other concepts, some other cases and have some fun debating this case a little bit. It. So to remind you, this was about the crooked police officer who accepted a bribe to, I was going to say docs, I guess that's not exactly the word, but to like, I mean, kind of reveal the identity of what turns out to be a fictional undercover officer, but it was the FBI using that to see if he would do it essentially. And that officer went and looked up a license plate to check whether or not this fictional person was an undercover officer. And the question of the the case was, did he violate the CFAA, the Computer Fraud and Abuse Act? In particular, what mattered was the exceeds authorized access part of the CFIA, as in the idea is he exceeded his authorized access when he looked up that license plate when he really wasn't supposed to be doing that. And the important thing here is that the statute defines exceeds authorized Authorized access, not entirely helpfully, but the language is by accessing a computer, quote, with authorization and then obtaining information they are not entitled so to obtain. And if you'll recall, there's a lot of textual ink spilled on a lot OF text written on the so. And we had so many people write in, a lot Of computer people, and we're going to talk about that as well. Well, ultimately, as we discussed in the Van Buren episode, Amy Coney Barrett wrote the decision and held that the police officer did not exceed his authorization because he had authorization to look up license plates, essentially. And at first to Jenessa and I, that seemed ridiculous. I, by the end, kind of changed my mind. And I don't think Jenessa did. We're going to find out. So did he exceed his authorized access when he looked up that license plate because he was kind of doing it for reasons he shouldn't have been doing it, essentially? Or as Amy Coney Barrett and the majority found, does it need to be something more? Does it need to be actually, you have to be on a computer that you're authorized to access, but then you go into an area of the computer thatyou shouldn't be, that you don't have a password to essentially, something like that, a file, a network drive, whatever it might be. And how does so to obtain factor into that? Last time, we didn't really talk about that that much. This time, we're going to talk about a little more, probably a lot more. It's really interesting. OK, full disclosure, when Jenessa explained her thinking on this and talked about some cases in other circuits, I really was having a hard time understanding it. And so this is a long episode and I cut it down, but I couldn't really cut it down anymore. And I don't know if people will be as confused as I was, I guess, hopefully not. But then the downside of that is you'd probably be annoyed at me for being confused. So I guess that's the best outcome is like you all understand understand it. And you're just like, Thomas, why don't you understand what Jenessa was trying to say? That's probably the best outcome. Or maybe you'll be like me and maybe it'll be just the right amount of time. But this is an extra long episode because of that. And I didn't want to, yeah, I'm not going to make it like two episodes. So hopefully, you know, people don't mind extra OA, even if it's kind of because Jenessa had to try to explain this argument to me a lot of times. And that's in the later half of the episode. All right. Enough of that? I hope you enjoy it. We And Wednesday, we'll be back with the horrors with Matt and Lydia, of course, for our... We haven't done a YouTube one in a while. We'll be black with that on Wednesday. Okay, we're going to take a break, which you can avoid at patreon .com slash law. Get the goodies. Get the lot off of movies that is out. That was so much fun. Get that. You heard the preview. Avoid the ads and get that warm, fuzzy feeling in your heart. And get an opportunity for merch. Lydia sent out some stuff recently, patrons. Patrons have responded. It's top secret, though, for non -patrons, maybe. Kind of. I don't know. Get on Patreon. You'll find it. All right, after this, I'll be on with Jenessa.

0:06:26 Ad: [Ad break 1 — ad music]

0:06:26 Thomas: Well, Jenessa, how are you doing?

0:06:29 Jenessa: I'm doing pretty good. Coming off nearing the end of my vacation, which I tried to spend as little as possible continuing to read about this case unsuccessfully.

0:06:33 Thomas: Well, I did the opposite and I hope you're ready because I am here to frankly defend Amy Coney Barrett, our queen, against your unwarranted and frankly sexist attacks. There I said it. I'm here to defend her honor. Oh man I think that this was a ton of fun I think a lot of people got engaged and sent us messages and stuff this did something that not a lot case law does which is it got me to read a bunch and if

0:06:41 Jenessa: Oh, I... Oh my god. Clearly. Yeah, I was joking. You somehow roped me into reading five more cases. Oh god

0:07:13 Thomas: You've gotten me to re physically read with my eyeballs I'm gonna have to say some things okay because if I've gone to that length no this is really interesting we have so much to talk about I don't know how we're gonna do it but after we did the first episode I was just so interested in kind of the, it just, cause it just seemed like we weren't on the same page. And I'm always like, okay, if I'm, I'm wrong, I want to know how I'm right. And so then I went and watched the whole oral arguments and that clarified, I think a lot of things for me. And then I was just still craving more information on this. Cause I felt like I still didn't have the right picture. So I went found the 11th circuit oral arguments. And listen to those. And first off, so funny, the difference in demeanor. I did want to make one point, which is that like what I think I love about this topic and what so many of our listeners love is there's one side of the law that's just going to be the law. Lawyers are experts and that's something that you can't and shouldn't replace, not with chat GPT, notwithanything. You need lawyers, they're experts. But there's a large component of legal discourse that is logical

0:08:19 Thomas: Arguments and stuff that I think a lot of people people like me who have an interest in philosophy, have an interest in skepticism. It's really fun, I think, for us to parse those arguments. And I think that's why so many people latched on to this episode we did, because it was a chance for in a apolitical way for once, because most of the time, let's be honest, the Supreme Court decisions, just from a purely like logical argument standpoint, can be kind of boring because it's one side wants to do stupid fascism and the other side is like, what are you doing? You know, like there's There's not there's not that much there, like in the Trump immunity decisions where it's like, no, you're just you're just trying to make a king and you're idiots, you know, whereas this one is like it's a nonpolitical issue. It was a weird split, you know, and so I just I think that's why I latched on to it. And I think that's why it's so much fun to try to like parse these arguments. And I really feel like I made some progress argument wise. But as always, I want to make some contentions about this to you. And then as the actual lawyer, if

0:09:19 Thomas: You're like, no, but this is dumb, that's what I want to hear. I would love to hear that. But so, oh, I do want to just finish the thing on the 11th Circuit. Correct me if I'm wrong. Feel free, because I'm not a lawyer. But then again, I don't know how much arguing in front of, like, Supreme Courts you've done. No offense.

0:09:37 Thomas: The demeanor, like the Supreme Court is supreme. Oh, sorry.

0:09:35 Jenessa: Not so much oh yeah

0:09:42 Thomas: This is the non -cursor. Is supreme assholes. I think the 11st Circuit isn't like the best. I suppose it really matters which three you got or whatever, because I think it was I always blank. Is that en banc or not en banc?

0:09:52 Jenessa: En banc is the whole panel

0:09:56 Thomas: Yeah, that's right. OK, so that's the panel. And then the en banc is when you get everybody. Right.

0:10:00 Jenessa: En banc bonk is everybody. And then you can have like just a panel of three people instead.

0:10:04 Thomas: For whatever reason. And those are arguments. There's just three justices. And one was from another circuit. It was weird. They're like, hey, our friend Jerry over here is he was in town from the different circuit was going to come help us out. That is interesting. I've never heard of that.

0:10:21 Jenessa: I just learned about this recently for the Voting Rights Act that you are required to do that, that it's like it actually has to be a trial court judge has to be on it.

0:10:31 Thomas: I like that. Huh?

0:10:31 Jenessa: It can't the panel is not made up of just the circuit. So I'm not quite sure why that would be for a CFAA case.

0:10:39 Thomas: Yeah, it didn't. It didn't make sense. But what was funny is they were so nice there. It was like the difference between these assholes on the Supreme Court who just bark at them and like me. It's awful. And then I get listen to the 11th Circuit and they're they're so delightful. They're so nice. And in my opinion, the guy on the government side and the 11st Circuit oral arguments was not the guy, the same guy. And he was terrible. It felt like he didn't do his homework and came in and was just like, so this book had a lot of great language.

0:11:10 Thomas: It was a lot of beautiful characters in the book. And I think we all know how good it was. We don't need to really say how it came across like that. And it could have something to do with that. Two of the justices on this or do you call them justices or judges? I don't even know. Two of The Judges on the 11th Circuit Court. Sure. Oh, well. Well, two of them were women. That could be part of it. They were so nice. They were like, they were so delightful. In the end, they're like, this really helped us. These oral arguments, like, thank you. This will really help. Like, it's just so funny to note the

0:11:25 Jenessa: I think it's usually judge and then it's justice on the Supreme Court. Yeah.

0:11:45 Thomas: Difference between that and contrasting that with Gorsuch, who's just an asshole. Look, Alito is the biggest asshole. I think we can all agree. But in a covert way, Gorsuch is like, man, he's almost worse in certain ways.

0:11:54 Jenessa: He's just nasty.

0:11:58 Thomas: Alito comes from a broken, victimized place. And by that, I mean, he is victimized himself. He's the, he's the ultimate victim. Gorsuch is just an asshole. Like he's just like so arrogant in a way that, oh yeah. Anyway, all that was delightful.

0:12:06 Jenessa: He really is. The snark. And yeah.

0:12:16 Thomas: And I do bring it up for another purpose, which is when I listened to that, what was funny was none of the oral argument was about the CFAA was about the computer stuff at all. Like that was barely brought up. They were talking about something that we've covered before that I think we should do an episode on this.

0:12:33 Thomas: The real debate in the 11th Circuit in this case. If you remember, of course, I hope you listened to the episode 1220. You have to get through this. Very confused. I will have set it up in the intro, obviously, but this was about the police officer who basically accepted a bribe from a non -undercover to out a fictional undercover police officer, et cetera, et cetera. And the real talk on the 11st Circuit was, wait a minute, the Supreme Court has ruined ruined bribery.

0:12:40 Jenessa: Or you're going to be very confused. Yeah. Mm -hmm.

0:12:59 Thomas: And so is this even really bribery, which is insane because if you and I just regular people are like, well, if you accept money to out undercover police, like how could that possibly not be bribery? And I want to be precise. This was about the jury instruction. So it does seem like the trial court judge, they did something where they didn't quite do the jury instruction right, possibly. And we can talk about it at a later date and you can give the, this is, this is what, this Is me talking is not a lawyer, not the expert, but it came across as because of the way the Supreme Court has ruined bribery law where they made it so specific that it almost is meaningless where it's like it has to be an official act but an official Act has to be like further defined to be like a current ongoing thing and they're like well is this wasn't a real investigation because it was a fictional officer so does that mean it was an official action you're like Jesus Christ but in fairness they won on that because they're They're like,

0:13:07 Jenessa: How is it not? Right. Yeah, yeah. Mm -hm.

0:13:53 Thomas: Well, you know, the Supreme Court has ruined the bribery law and you got to give the jury instruction better because it's possible that based on the stupid Supreme Court way they've defined bribery that this wasn't an official act. It's at least possible. And you have to at least have informed the jury in a certain way.

0:14:12 Jenessa: Mm -hum. Yeah.

0:14:12 Thomas: You know, it's more technical than I'm making it. And that's why they prevail on that.

0:14:16 Jenessa: So I didn't listen to the 11th oral arguments, but I did read the 11st Circuit decision. I read it a long time ago, like before this ever went to the Supreme Court, and then I I reread it recently because we were talking about this. And yeah, just as like, you know, I guess a teaser, the 11th Circuit did a really impressive job of saving this despite what the Supreme Court has done to our bribery statutes. They made it work.

0:14:38 Thomas: Mm hmm, ooh. Ooh, with the bribery statute? Because they, I thought he won on that.

0:14:48 Jenessa: He won in the sense that they said the jury instruction was bad. But what they could have said was, what you did isn't bribery. And instead they said, no, with a better jury instruction, this absolutely could be bribery. New trial.

0:14:56 Thomas: Oh, right. Gotcha. Right, right, right. Good point. Yeah, no, a very different thing. I forgot there was that possibility. As always, great to have a real lawyer.

0:15:09 Jenessa: They rescued it in a way that made it still triable.

0:15:14 Thomas: And my sense from the oral argument was that like, like kind of thought this was bullshit, but we'll grant that with a jury instruction, it could have. So I guess my interpretation wouldn't be so much rescuing it as like, all right, we'll kind of give a nod over to the idea that this couldn't have been bribery because that was more how it came across in the oral arguments. But it's funny the difference between like hearing them talking about it and versus writing the decision.

0:15:39 Thomas: But anyway, this I think should lead into what I would like to contend to you is that I think, and I'm serious about this after reading all this, I think our queen, we stand, totally joking, hope people know, Amy Coney Barrett is entirely correct on so. And what I believe is happening, what I'm pretty certain about just from a logical argument structure is that the government is actually the assholes who were trying to make so a thing. The government was trying to smuggle their view, in my opinion, their view of access to a computer and all that. Just as a reminder, again, I will have reset in the intro, but to access a computer with authorization and to use such access to obtain or alter information in the computer that the accessor is not entitled so to obtain or alter. And then, of course, there's the exceeds authorization that we'll get to. But when it comes to the so part, they want to sneak purpose into to entitled. And the way they try to do that is with so. So you noted that Amy Coney Barrett goes on and on about so in the decision. And I don't have the context to know how abnormal that is. And so I'll certainly defer to you there. It is several paragraphs. But in my opinion, I think she is doing that to defend against a pretty honestly kind of dumb textualist argument from the government side that ultimately didn't prevail. So I actually see her as taking what is an obnoxious argument and going maybe too long on it, but like explaining why the so doesn't actually mean what the government wants it to mean and

0:15:52 Jenessa: God damn it. Sure.

0:17:17 Thomas: Means what I think you and I would assume it means. Once explained, I think what most people would understand the so to mean. So that I will admit to, I didn't understand the, so when we first recorded, I understand it way better now. I think I understood it by the end. So in the end of the recording, I think my position on it made sense. But let's talk about so to obtain. What I think is really interesting, what really made it hit home for me, I'm not telling you anything you don't know. I think you said elements of this, but it's about me kind of putting it together after having all the information and realizing like, oh yeah, that's what you were getting at. We've got an argument over so. So to access the computer, as I said, dot, dot dot, not entitled so to obtain or alter.

0:17:58 Thomas: And then you go to the Black's Law Dictionary. And now how is that pretty normal is a law thing.

0:18:05 Jenessa: The act of opening that dictionary. Yes. I yeah. You know, I'm going to say like I think she drags it out painfully. But the general thought. Yeah, of course. Yeah. And Black's Law Dictionary, the purpose there being because we're interpreting a law, not a contract or something. Thing we want to give it the plain meaning lawyers would have given it because congress wrote this right and they're trying to write a law so we're going there instead of like Webster's although they will go to Webster's all the time too exactly

0:18:34 Thomas: Yeah. I feel like that when they want to, it depends. Yeah. So

0:18:46 Jenessa: That's largely my beef with a lot of this textualism is it mean it's much like originalism it means whatever you wanted it to mean you know in general it's not like weird to do that

0:18:49 Thomas: I think that the government is trying to say so to obtain, entitled so to obtain, can also like encompass a purpose in there. As in, as we discussed, okay, you're entitled to to obtain the license plate information, but not for this purpose. And you know, there was the car example. Okay. I lend my keys to my babysitter. She's entitled to, you know they're entitled to get something from my car, but they're not entitled to take my car. So that would be like exceeding it.

0:19:17 Jenessa: Scope of consent is what we would normally kind of put that in

0:19:22 Thomas: What's so funny is I came up with all these arguments and then I read the actual decision and realized they are exactly what I was thinking. Because not only does she say what I was thinking, then the dissent makes the point that I was like, was my rebuttal. But then also, so they reply to that with the thing.

0:19:39 Thomas: So I went through this whole thing in my head and was like, wait a minute, that's what the decision is. So I actually like this decision. It was satisfying because I was like oh shit, that is what I was trying to say but in law words. I think the real debate is on just what entitled means. It is on the only way that you could get the government's side on this particular question in my opinion is if you read entitled and they discussed it in the oral arguments to include like a scope. Like, it's sort of implied, like, well, yeah, if you're authorized, if I've entitled you to access this thing, that kind of includes a scope.

0:19:43 Jenessa: Arguing with yourself

0:20:12 Thomas: That includes a purpose, impliedly.

0:20:11 Jenessa: Yeah yeah it feels like it has to it's sort of what the dissent will say

0:20:18 Thomas: Yeah, and so the focus on so, I think, is a way that the government tried to get it in there. Because the truth is, the statute doesn't explicitly say purpose. I think what the government thought was, hmm, well these are textual assholes, so what if I try to find, again, this is just my opinion, I could be wrong.

0:20:34 Jenessa: Yeah yeah yeah no I mean it's a good thought

0:20:37 Thomas: Yeah, they're trying to find a place to get in purpose in there. And the so to obtain is a weird construction that I think they thought they could do it. But Amy Coney Barrett takes a lot of time to explain that the so, and I think there's actually a good textual point. I think this is a fun language point. When you say or entitled so to attain, the so has to refer to something you've already said. Otherwise, it makes no sense. Van Buren says he notes that so as used in the statute serves as a term of reference that recalls, quote, the same manner as has been stated, or quote, the way or manner described. And that's kind of a Black's Law Dictionary reference as well, apparently.

0:21:14 Thomas: It's stated, which is via a computer. You can also contend that it's via a supercomputer in a way that exceeds your access, because that's also previously stated. But it doesn't add in a purpose component. And I think that that's interesting because, in my view, they shouldn't have bothered arguing about so, like, at all. Because so to obtain, honestly, I think it's pretty plain language that you're just referring back to what you already said. And the reason the so is important is not for the government's argument. I think it's actually, if you're looking at like why Congress would have possibly written that, because if you were charged with accessing something in this way, you could make a defense of to access a computer with authorization and to use such access to obtain or alter information in the computer that the accessor is not entitled so to obtain her alter. Now, pretend there's no so. And it just says that the accessor is not entitled to obtain or alter. Now, what someone could argue is, let's say they accessed records on a computer that they actually could theoretically access on paper. And so they could argue, oh, wait a minute. Yes, I hacked the mainframe and I'm speaking loosely. Yes, I accessed it through maybe a way I wasn't authorized to computer wise, but turns out I have authorization to access these physical files or another example they give is I could have FOIA'd that or something. And so technically speaking, I have

0:22:42 Thomas: Authorisation to access or obtain or alter that information. And so it's really to prevent that, to say like, well, no, no. It doesn't matter that you could theoretically access this information in some other form and be fine. It doesn't matter. If you use a computer to hack information that you already could have gotten, that should still be a computer hacking crime.

0:23:05 Thomas: And that's what the so is doing. That's why the so was actually necessary.

0:23:08 Jenessa: Well my understanding is there's another piece to it right that it says um it's if you're accessing information in a computer, and that's what that is meant to do, is to say, you accessed it in a computer. We know that it is absolutely true what you're saying. It is not an excuse that I could have accessed it through a FOIA or go into the library, or even within our agency, I could have gone down to the file room and gotten the physical paper piece. It's absolutely not an excuse to say that and therefore I broke into the computer system and got a digit.

0:23:47 Jenessa: It's not going to get you around it. You're absolutely correct about that. My understanding was there was a, I'm looking for it now and not finding it, but there's a part that said in the computer and they were like, why the hell is that in there? And that's what that's supposed to be for. But certainly, I mean, you could make that argument that it's addressing that. What we definitely need is barrett addresses this non -superfluity nothing's superfluous if taking the word so out changes nothing then that can't be allowed so it has to be there for a reason. Now I would argue it's goddamn two letters I don't know that in for the government or her it does like whoever's arguing. I'm like, Jesus Christ, people. It's two letters. But yeah, yeah.

0:24:24 Thomas: No, I, I. Okay. OK, once again, I think that was the government trying to pull a fast one again. And the government was trying to say, hey, the so because, again, from the government's perspective, they're trying to sneak purpose into so remember. And so and I'm just this is remember to the to the audience, because I know this is so like painfully textualist. They're trying To sneak more meaning into the word. So and so I think a tactic they're using is to say hey, if you don't add purpose into it, if you don't say, well, no, the so to obtain means, you know, you have to be authorized for the purpose, meaning the police officer who accessed the license plates, even though he technically has computer access, he doesn't have access for that purpose. The government's trying to use that principle you're describing, which makes sense. You wouldn't want to read a law to be like pointlessly redundant if possible.

0:25:19 Thomas: Like it's, I kind of like those, those little like tools that are not, they're not, yeah, like rules of thumb. Yeah. It's interesting. Cause like a lot of them make a lot of sense and they're just kind of logical. But then I think if you lean on them too much, you know,

0:25:23 Jenessa: It's a good rule. It gets abused, but it's a good rule.

0:25:34 Jenessa: Right. That's how I feel as well. Yeah.

0:25:34 Thomas: That it's sort of like, well, it should be like an all things being equal type thing.

0:25:37 Jenessa: Yeah yeah it's a better way to think of it.

0:25:40 Thomas: So they're like, Well, no, the so has to mean, you know, this purpose. Otherwise, it's what's it even doing there? It's going to be useless. And I and again, I'm going to defend ACB's honor. I think that's why she puts more time into that to say, Well no, it still does have a purpose. It makes it so the thing we already said, which is the purpose of it is if I access the personnel records that I could have FOIA'd, I don't have the defense of saying oh, well, I would have been able to access the paper records. And I think she's right about that. Honestly, that makes a ton of sense to me.

0:26:09 Jenessa: Yeah that is definitely a true fact about the law. This law specifically that like yeah that excuse issue. I just could have sworn that that came from somewhere else, but I am not spotting it in the law yeah the um there's some other outside of that exceeds authorized access definition there's a larger thing for all of them

0:26:21 Thomas: Are you talking about the computer thing? Well, I was going to make the point from what you said. I noted that in the computer was a stupid thing. And as I read the decision, well – I think we're saying the same thing, though, because I think it's via a computer versus a paper record versus a computer record. But I did want to note, because I thought in the computer was like so, you know, Zoolander and dumb, you know, it does say early on, though, and this is where let me know if I'm reading this right. But it does seem like over time that has now just been read to mean any computer information of any kind. And it's not like literally in the supercomputer, because early on it says, quote, it has since been expanded to cover any information from any computer, quote used in or affecting Interstate or foreign

0:26:36 Jenessa: Oh yeah that in the computer that's why that's there yeah yeah yeah I can't stop thinking of zoolander the whole time yes

0:27:16 Thomas: Commerce or communication. As a result, the prohibition now applies at a minimum to all information from all computers that connect to the internet. So there you go.

0:27:25 Jenessa: Yeah that's where um protected computer so he got prosecuted under a to b and there's also a to c here which is information from any protected computer and a protected computer is defined as a computer affected by or involving interstate commerce effectively all computers with internet access

0:27:46 Thomas: And part of that is apparently this law was just about government employees initially. So it was just about, and

0:27:52 Jenessa: Yeah there was one about two-ish years earlier that was much more limited and then this got

0:28:00 Thomas: So I think the analysis of so in my opinion is because the government was trying to pull a fast one on. So I really think it was, I think, I think ACB went a little crazy with maybe analyzing it too much, but I kind of think that's what it was. So in terms of the overall feeling that you and I at least had initially that I kind of changed my mind on, I'm not sure where you are, but the feeling initially that like, wait a minute, it's pretty obvious that if I'm entitled to obtain license plate information for my job, for proper job stuff, but like I do it for like a corrupt purpose or for whatever, it may be personal, whether it's a bribe in this case or whatever, Well, there's a feeling that you and I both had initially that's like, well, yeah, that could be, you know, exceeding my authorized access. Then Van Buren tries to bring in. So the plaintiff tries to bring in this idea that like, well, if it's allowed to be just like a purpose -based authorization like that, like a loosely speaking,

0:28:09 Jenessa: Expanded yeah mm -hmm

0:28:53 Thomas: Not like a computer code authorization, like literal a password or whatever, then you bring in all this like, then that's the dating website crap where you're like, well, then it's like all that. And I don't really go for it. I think another thing that had me confused on this Supreme Court case was there were, I think, in my opinion, bad arguments that either side used badly that actually made their case worse. So then I got mixed up as to like, wait, wait. Who's arguing that and why? But it's like both sides were trying to argue that like, no, the other side's like interpretation would lead to this thing and it didn't make any sense.

0:29:01 Jenessa: Yeah all the stuff yep yeah oh yeah

0:29:27 Thomas: But the actual good argument along those lines that made sense to me was, what if instead of that, it had been the officer supervisor said, hey, is it Van Buren? Hey, Van Buren. And again, a hypothetical was not like that crazy of a hypothetical to say, hey. No more looking up license plate information until you go out and do this other cop work. Like, hey I need you to be out there pulling over people. Whatever. Who knows?

0:29:27 Jenessa: Yeah yeah

0:29:58 Thomas: What if it's some verbal directive from their supervisor that's like, hey, no, you don't do this part of your job right now until you do this other thing in a way that would kind of be the same level of unauthorized because it's really again, it's not disputed by either side that Van Buren did have the ability and the access and the authorization to get that information. Right.

0:30:20 Jenessa: Yeah nobody tries to claim on either side that he could have been charged with the not authorized. Everybody was going for exceeds authorized access. So not authorized does not get addressed in this case, which I actually think ends up being a problem.

0:30:34 Thomas: Interesting. Well, I think I will be able to let you get to that soonish. But but the I think this this made it click even more for me because it would be weird if the difference between being guilty of a computer hacking, a federal computer hacking crime would be like, well, my supervisor said, like, hey, don't do that work until you do this work over there. That's kind of the same level of unauthorized in a not legal sense that it is for him to just be like looking up a license plate and the real problem again and this is why I ultimately came down in the end I'm kind of on the majority side on this case I think there's some problems with it I'm curious to hear maybe you'll convince me there's more problems of it but ultimately it would be a little weird if you were guilty of a computer crime on the basis of oh yeah my boss did say, don't do this until I'm done with my other work, which is kind of like, you know, yes, he's looking up a license plate for corrupt purposes, for bribe purposes, but that should just be bribery.

0:31:00 Jenessa: Arguably. Yeah mm -hmm yeah

0:31:33 Thomas: That should just be that like, that's the problem with there, because imagine if all these records were just printed out and he just went and grabbed the record of the license plate that he shouldn't have been grabbed. All the facts are identical, except the records are printed out. It would be weird to say, oh, well, in this printout example, he is not guilty at all of any of that stuff. And then the computer example, he's guilty of like this hacking law that can be pretty serious.

0:31:56 Thomas: That seems arbitrary to me. And there's a good way that I think it was summed up here. Because purpose -based limits on access are often designed with an eye toward information misuse, they can be expressed as either access or use restrictions. For example, one police department might prohibit using a confidential database for a non -law enforcement purpose and access restriction, while another might prohibit using information from the database for an non - law enforcement purpose as a use restriction. Conduct like Van Buren's can be characterized either way, and an employer might not see much difference between the two. On the government's reading, however, the conduct would violate the CFAA only if the employer phrased the policy as an access restriction. An interpretation that stakes so much on a fine distinction controlled by the drafting practices of private parties is hard to sell as the most plausible. And I can't comment, obviously, on like how sound the legal reasoning is there.

0:32:39 Jenessa: Mm -hu mm

0:32:53 Thomas: But from a logic perspective, that's kind of what I was trying to get at. And it was cool that then I read that. I was like, oh, yeah, that makes sense. It would be pretty arbitrary if you're only guilty of this computer hacking laws, pretty serious federal computer hacking law. If your department happened to write the conduct is like, well, you don't have access for this versus, well you, you can't use it for this, which would be a pretty big difference and it would be pretty arbitrary.

0:32:53 Jenessa: -hum mm -huh yeah yeah and there are lower court cases that harp on this. I definitely think more artfully that go through like, hey, in one case, they severely limited exceeds authorized access. I think largely the same way that this case did, coming up with pretty much the same definition. Granted, that's out of step with the other circuits. But they did it with kind of that same rationale saying, hey. This would depend heavily on how companies write their employee handbooks. And like, this is something that is kind of arbitrary, not necessarily, but the way that companies write their employee handbooks can be arbitrary, subject to change, rarely read. You know, you should read it, but a lot of people don't. They're long. And so the Ninth Circuit kind of wrote theirs as if like, maybe we don't get into these little squabbles between employers and employees. They write it as like I don't think congress meant us to be doing that so um I think there's a more artful way to say I just god I just can't stand her writing I think she's brilliant in oral argument and then she just starts to write and I'm just like I my eyes glaze over I can't deal with it but I do think that example is an exceptional one that it is like god if they wrote it slightly differently that's not congress writing a law that's like some guy wrote a policy, especially when we talk about a private employer. I do think when the government agency writes a policy, like somehow in my head, that should have a little more force. I do think it's a really good point.

0:34:59 Thomas: So ultimately I guess I'll try to round out my thing here and maybe you, uh, you'll convince me otherwise. But ultimately, I think this pretty well nails it, in my opinion, because I think when you're dealing with a criminal statute like that, that could be that arbitrary based on that wording authorized has to be like a bare bones, like technical sense, as in you have a password or you don't. And that's something that or something like that.

0:35:23 Thomas: That's something that's kind of inarguable. And when you're dealing with possibly putting people away for many years, I feel like it can't just be, oh, there's a place in the handbook where it said, don't don't access it for this purpose. Like, I think that to that, to me, that that seems fair. Like, that seems like a fair way to do it. Now, it does seem a little tricky when it comes to, like, reconciling that with how the broader statute is supposed to work and like how that's evolved with computers today, because I do think it's funny that they put all this emphasis on. So.

0:35:54 Thomas: And then there is a sentence where she rephrases it, quote, the phrase is not entitled so to obtain is best read to refer to information that a person is not entitled to obtain by using a computer that he is authorized to access. And then I was thinking like, oh, yeah, that's that's her, you know, saying like, you know essentially what I was saying.

0:36:12 Jenessa: Kind of articulating it, yeah?

0:36:14 Thomas: It's weird that I think she doesn't realize that that's just restating the problem if you think authorization has a necessary purpose in it. So I think I think her writing, she kind of hand waved at that. Like there's a point in the decision where she's like, but we've already dispensed with the idea that there's A Purpose involved in AXA. And I was like, wait, did you? I don't. Yeah, I was. I really genuinely was like I know I read the whole thing and I don'T remember you doing that. So I guess that would be my critique of the decision would be, I don't actually

0:36:34 Jenessa: And like we really haven't. We absolutely have not yeah

0:36:45 Thomas: Understand fully. I agree with it, but I'm not sure I totally understand legally how they dispensed with the idea that there's no purpose involved in entitled. And I think they should have spent more time on that and less time on. So, but there you go. That's ultimately Thomas's, like as a lay person getting hooked on this idea and trying to figure it out. And I rest my case and await your response as to why why that might be wrong

0:37:17 Ad: [Ad break 2 — ad music]

0:37:17 Jenessa: I think we probably land in similar places probably partly because I care far less about this but I'm not a criminal defense lawyer not gonna affect my life no no in terms of uh being married to any particular outcome no I am not um in terms of um like certain legal interpretations I think like yeah this public policy argument I think is very compelling and it's part of why I said like I think sotomayor would have written a very different decision

0:37:24 Thomas: That's always good when you're arguing with someone like yeah sure actually I don't really care so fine you win

0:37:48 Jenessa: The ninth circuit here basically lands on her exact outcome and definition but just from a different perspective so like they address that so like I said this is in conflict with the the other circuits but it ends the way she ended so like they win right

0:38:04 Thomas: Oh that's interesting I wanted to note something about that because first off I do want to you know I do want to say that one of the reasons I I was so hung up about this is because I did get the impression that you were kind of strongly disagreeing with this case with the decision And so I think it'll be confusing maybe for people as to why I had so much energy and you're like, yeah, no, pretty much. So like that was kind of why I was so interested in this is because we disagreed and I wanted to figure out what was going on there. And one thing that you said when you're talking about that is about circuit split and is about like whether or not authorization. And I did want to note something that I read in the decision, which said Van Buren appealed to the 11th Circuit, arguing that the quote exceeds authorized access clause applies only to those who obtain information to which their computer access does not extend, not to thosewho misuse access that they otherwise have. While several circuits see the clause Van Buren's way, the 11th Circuit is among those that have taken a broader view. Consistent with its circuit precedent, the panel held that Van Bure had violated the CFAA by accessing the law enforcement database for an inappropriate reason. So I take that like when she writes that, I wonder if she's being a little sneaky here. I take that as a plain reading to say the 11th circuit, the one that went with Van Buren and had the more broad reading. I think that to be the outlier based on this paragraph,

0:39:26 Thomas: Which would then make me wonder if this decision was something that you were saying was like super wrong. But then I also read this paragraph that's like, well, the 11th circuit is the only circuit that kind of had this the other way then I would wonder like what's going on there you know what I mean like if the other circuits kind of okay so that's okay please yeah please let me know

0:39:43 Jenessa: Yeah but it's not yeah yeah so um there's decisions from uh prior to this from the 11th circuit oh yeah the third fifth and 11th have all had this broader interpretation where exceeds seeds authorized access involves this scope of consent idea I'm not suggesting that's the only right way to go but there is a reason that multiple circuits went that way for like decades um it's not like it's Not an insane thing to think

0:40:15 Thomas: Gotcha so it sounds like sure so it's not like maybe she's playing a little bit fast and loose by but because again when I read that paragraph it comes across like the 11th circuit is this big anomaly and so I wonder if that was intentional on her part yeah

0:40:26 Jenessa: Did something weird yeah yeah so like the ninth here has a panel decision that went her the way she went almost identical reasoning and then the dissent is like guys what are you doing here's all these other circuits who went the other way and the reasoning behind it that is just like very common sense the way they dispense with the so thing um they just say okay the government says it means in that manner it has to refer to these restrictions if you read it too narrowly you render the word so superfluous so implied here of course is that rule that like it can't be superfluous they put it in here for a reason and they basically dispense with it by saying hey um if we read it your way now granted they do that parade of horribles thing of like oh my god you're gonna get in trouble for a dating website so clearly the same people are writing amicus briefs everywhere and giving them the same examples they say I'm pretty sure the government didn't want to criminalize all of these behaviors on on the basis of a two -letter conjunction.

0:41:34 Jenessa: I'm not going to hinge my decision on that. Like, if that's your only argument, you're done here. You need so much more than that for me. That's a way to handle it. And they also brought in, they didn't by name, but they brought in a thing, the principle of lenity, so lenience. It's a general thing where Gorsuch is a huge fan, and Kavanaugh is not, so this might start coming up more and more.

0:42:00 Thomas: Really I thought they both were I misunderstood ah gotcha

0:42:04 Jenessa: Yeah, not in this case specifically. It's a more general principle. Gorsuch will adhere to the strict version that I think a lot of people will like. It is this idea that as a matter of due process, if there are two reasonable interpretations of a law, and one of them makes your behavior a crime and one of them doesn't, we should go with the one that doesn't.

0:42:26 Jenessa: So it's not all the way to like unconstitutionally vague, but it's still a way to, and we don't have to worry too much about which one is the exact one Congress intended. We're more saying, hey, the average citizen has to read this law and know what's illegal. If there are multiple interpretations possible as a matter of constitutional due process, you should, Gorsuch would say you should have to pick the most lenient.

0:42:57 Thomas: And and it's funny because it fits with you know we uh went over gorsuch's stupid book and I say we I mean matt read it and there's no way I would ever read that anything but it fits with Gorsuch's and he even makes reference to it in the oral arguments It's like he's trying to make his book, even though this is this predates his book. But I think he had it in mind, probably because I'm sure he was he was writing it where he's like, well, there's so many laws, you know, because reminder, Gorsuch's book was overruled. And it was about how there's just too many darn federal laws and everything's a crime. It's like a you know. So it goes in line with like a conservative small government slash. Also, by the way, his, of course, hatred of Chevron, you Know, and like this idea that the yeah, the federal government is too regulated. Lady. And so I think it's interesting to like, I made that connection to that past OA that maybe listeners will remember where it kind of connects back to like his whole philosophy of like, aren't there just too many laws that

0:43:35 Jenessa: All regulation. Yeah yeah.

0:43:50 Thomas: Just make too many things a crime? And so therefore, if you can read it in a way that doesn't make this a crime, but saying, having said all that, I don't mean to poison the well. I kind of think that principle makes sense. What do you think?

0:43:50 Jenessa: I think so too. Yeah I like especially when it comes to criminal law and I think this is a great example where it would be a way to cage it that says okay from my perspective do I think this is what Congress meant? No. And I can make you that argument in a minute. Do I think this is a reasonable interpretation? Yes. Do I think it's a genuine concern that like give the government an inch they'll take a mile especially if they're prosecuting you for a couple of things would they tack this on?

0:44:14 Thomas: Oh, interesting. Interesting. OK. Yeah. I want to hear that. And

0:44:33 Jenessa: This one is almost depending on the circuit reads like a general intent crime like Like, it's almost concerning. Do you have to know you weren't supposed to be here? Oh, my God. Right?

0:44:42 Thomas: To add one quick thing, too, that I always forget and I think sometimes a lot of people forget is even if we don't see the cases or convictions on this, is the government tacking it on to get a plea deal that would be otherwise worse? Yeah. Like are people pleading to time because they're like, hey, you're also violating this hacking law.

0:44:54 Jenessa: To scare you. Yeah.

0:45:02 Thomas: And we would never even see that. Like there's almost no way for us to know. Does that happen? Because what would happen in the end was a plea deal was signed and you didn't, you know. So that's another thing we always often forget. Head.

0:45:13 Jenessa: And the Ninth Circuit points out any time something is, if it's hypothetically possible that you could be prosecuted under this for accessing your personal email on your work computer, when we know almost everybody at some point has, like, you know, Googled the sports team results on their work computer, which would technically probably violate most employee handbooks, if one person gets in trouble for that and nobody else does, like laws that are rarely prosecuted are ripe for abuse and for discrimination to be used against some people and not others. There is a great public policy argument to say, if I really dig down from my perspective, Do I think I strongly suspect Congress did not mean this extremely narrow interpretation, but there is a great public policy argument to say it could have you could interpret it this way. The average citizen reading it, trying to police their own behavior, tryingto obey the law, could read it as this more narrow thing. And like maybe especially from like if Sonia Sotomayor wrote this there there's other ways to just criminalize this if we had a function in congress they could rewrite this to be a little more clear um yeah

0:46:30 Thomas: That's so interesting. I'm really curious to hear that analysis because when I read this with kind of the more information perspective that I got from doing all this like listening to oral arguments and reading this decision, I felt like, okay, actually maybe this is what it's meant. For one, this is from the 80s. So this does not come from a time when anyone was checking any email on any workplace except for like the most super tech savvy

0:46:52 Jenessa: Certainly I think we can agree they did not mean to criminalize lying on a dating website or checking your work checking your personal email they definitely didn't mean to criminalize

0:47:00 Thomas: Yeah yeah and I think it came from a time when access was more like strictly speaking are you the hacker are you the computer person in the 80s movie who like I have access to the mainframe or not and so I I found it plausible that they they might have been intending to mean access in a very literal computer code

0:47:18 Jenessa: That yeah yeah I do think it's plausible and that's why it would be within reason to do this because if it is like crystal clear what they meant if you're really doing the legal thing you can be stuck with a total dumbass law with terrible outcomes like judges shouldn't legislate from the bench here we go unless it's like so stupid it's unconstitutional but I do think there are multiple reasonable interpretations. So that's why I think you can reasonably go with lenity, public policy. Yeah, let's just go with the narrower interpretation because it is ambiguous. Like, let'S not pretend this is written in a way that is clear.

0:47:42 Thomas: Sense

0:48:04 Jenessa: It got to the Supreme Court for a reason, right? Like, this is not like, oh, yeah, everybody knows what that means. All that being said, the first thing that I think is super important, which sucks, I understand. These words do not have technical computer science definitions for a couple of reasons. And like, trust me, I sympathize. I have been there with how many like mental health laws are using weird definitions and like, yeah,

0:48:20 Thomas: Yeah well and you should say you I think you said off mic before you wanted to bring this up because a lot of people computer people wrote in kind of from that angle like interpreting it with an actual computer

0:48:40 Jenessa: Yeah, and I think their definitions would be awesome to put in a rewrite of this law. It would make so much more sense to do it that way. Recall that this was written in the 80s and it was written by random lawyers some of whom may or may not have been lawyers working in congress um they actually wrote it I swear to god it is in the house committee report they watched the movie war games and were very freaked out about the idea that someone was gonna hack the mainframe and drop bombs on us and so we're in in the middle of like absolute panic, red scare. Is the red scare still going on in the 80s? Yeah, right? I have no sense of time. So computers were new to people and everyone's scared of the Soviets.

0:48:44 Thomas: Mindset yeah oh man yeah exactly yeah oh yeah Yeah, for sure. Yeah. It's like, yeah.

0:49:27 Thomas: Well, let me think. Had Rocky IV solved it yet? I'm trying to think. Did Rocky IV, where he's like maybe if you could shoot for me, then maybe we're not so different. You know, that's when it solved the Cold War is my memory of history class.

0:49:40 Jenessa: So, okay, we've got exceeding authorized access and without authorization are going to appear. There's seven different possible crimes. We've only been talking And in four out of the seven, you will have both without authorization or exceeds authorized access. And in three of them, you'll only have without authorization. So they are non-superfluous. We do have to treat them as they are two separate things. If we ever define one of them such that it is fully encompassed in the other, from a legal perspective, we have done it wrong.

0:50:11 Thomas: Sorry. What do you mean when you say that we're we have crime? Are you looking in the record like the congressional record or what? What do You mean?

0:50:17 Jenessa: The definition. So we are in section 18 USC 1030A will define seven potential crimes that let you violate the CFAA. Some of them are misdemeanors, some of them Are felonies, and they have different definitions. So some of them you can violate by accessing a computer without authorization or exceeds authorized access. That's four of the seven work that way.

0:50:47 Jenessa: Three of the 7 you can only violate by access without authorization. First of all, the fact that they say two separate things means they're separate. But we're even more sure they're not the same thing because some of these laws you can ONLY break without authorization, you cannot exceed authorized access without authorization is one thing and exceeds authorized access is another

0:51:05 Thomas: Sorry, what are not the same thing? Well, yeah. OK, so we all agree on that, though, right? Interesting. OK. How so?

0:51:13 Jenessa: Yeah um my concern is that we are accidentally defining them to encompass one another let me go through and I'll see if I can help you make it make sense well first of all let us just say I guarantee you amy coney barrett knows nothing about any of these computer things miss I don't know what a thumbnail is if you recall from the youtube decision when she said what if it's not a thumbnail what if it's a frame from the video that they chose and the air just sucks out of the room as this attorney is like oh god what did you think I was talking about for the last 10 minutes that's a thumbnail ma 'am so like she oh man she literally is like doesn't know what a thumbnail is

0:51:42 Thomas: Oh, no. Jesus. Pin in that. I didn't remember that. We got to go to that sometime. OK? Not good.

0:51:58 Jenessa: And for 10 minutes they've been debating thumbnails and it's just it's tragic okay. So I guarantee you she was not thinking through how computers work when she wrote that decision.

0:52:01 Thomas: Not good? OK. Sure. Sure?

0:52:11 Jenessa: We've got without authorization exceeds authorized access. Exceeds authorized access is given a definition in the law. We've read it a hundred times now. If a word is given, a definition, in a law, a contract, a patent, whatever, we are stuck with it. If you defined it a way we don't normally use it, that's the definition. Too bad. If we don'T define a word in a patent it will get its technical definition.

0:52:35 Jenessa: So if this was a device for neurosurgery, we'll open a neurosurgency textbook. In a contract, if it was like between merchants who sell the same kind of goods, we might give you a definition that like you guys use that's like industry terms. Yeah, exactly. But for the most part, in interpreting laws, interpreting most things, we're going to give things their plain, ordinary meaning. And without authorization, never gets a definition.

0:52:50 Thomas: Mm-hmm. Term of art kind of thing. Ah, so it can't be. I see what you're saying. So just as a general legal matter, like just talking about legal principles, if a term is not defined in the law, that's kind of interesting, the patent thing. I didn't know that. So if we're talking patents, then you still can kind of go with a technical thing. Very interesting. But if not, you're kind of stuck with a plain meaning, which still strikes me as like there's a lot of work to do from there to figure out what the plain meaning is.

0:53:08 Jenessa: It's not computer words yeah yeah you will get technical yes yes

0:53:32 Thomas: But the point is, it doesn't mean you get to assume a highly technical definition that wasn't in the law, just because even if it's right, like, even if it's like, as I'm sure so many of the people writing this in are probably right about like what that should mean or does mean technically. So it's not about that. It's about the way the law works. I think it's an excellent point that people should, that I didn't know that we should keep in mind that if it's not defined in there, you kind of, it would be great if we could be like, well, let's get Bill Gates in here. I don't want to get Bill Gates anywhere, Epstein boy. But let's get an actual computer scientist in here to tell us they don't really do that. It's got to be plain language or

0:53:30 Jenessa: Oh yes yes right oh god yeah absolutely yeah yeah yeah oh god mm -hmm

0:54:09 Thomas: Unless it's defined in the statute. So wait, which part isn't defined?

0:54:12 Jenessa: Without authorization gets no definition exceeds authorized access got a definition

0:54:15 Thomas: Because without, ah, gets a definition dependent on that other one, right? Dependent on without authorization.

0:54:21 Jenessa: By definition it's still sort of saying we all know what authorization is, right? So without authorization means without the thing we all know what it is. And exceeds authorized, yeah, also

0:54:25 Thomas: Yeah, yeah, that's all I meant. Yeah, exactly. Which is, yeah. It's funny. So I just want to make that point that it didn't, it's not like that one received a technical definition and the other one didn't. Yeah okay that's all I wanted to say yeah

0:54:44 Ad: [Ad break 3 — ad music]

0:54:44 Jenessa: The exceeds authorized access definition that we are stuck with is also not technical and is very confusing and led to a circuit split in like 400 cases. It's not the most helpful definition, but it is a definition. So what we ended up with in the lower courts, and this hasn't really been touched because keep in mind for Van Buren, nobody said he was without authorization. So nothing, nobody briefed an argument about at all. Nobody briefed what is without authorization mean. Nobody oral argued it. The decision didn't touch it. What the lower courts have said is it has its plain and ordinary meaning, which means you're not allowed to be here.

0:54:54 Thomas: Interesting so they didn't touch that part of the law okay ah

0:55:26 Jenessa: So you do not have to overcome any technological barrier it's not hacking it's being where you're not supposed to be I

0:55:34 Thomas: Well shit that doesn't help us at all does it wow huh

0:55:37 Jenessa: Know it doesn't so we end up with this problem that it's way broad it's so much broader um a lot of people talked about which I think would be a great way to establish this and probably would mean these two would be I don't know somebody can tell me what you think whether these would be punished equally but like it would make sense to have without authorization is like you just are an unauthorized user you're not supposed to be here and you hacked into a computer and exceeds authorized access is like this escalation thing where you had authority to get in here and you abused that but they were still talking about like essentially a hacking type of thing unauthorised means like uh in one of the cases so this is what's so strange ninth circuit get decided about the same guy. It's never good news when you keep coming back to court.

0:56:30 Jenessa: When he directs, so he's going to get accomplice liability. So always just come back to what did the people he directed do? He's liable for what they did.

0:56:39 Thomas: So he didn't literally do the hacking whatever thing but but okay but he's liable

0:56:41 Jenessa: Right, exactly. He's a former employee. He directs current employees. Use your login information and get me some stuff. So effectively as accomplice reliability, treat it like he logged in with his login information and got some stuff, they did the narrow interpretation of exceeds authorized access and they said, listen, they used their login information to go into a system they are allowed to go in and they got information they're normally allowed to get and they just did it in violation of the employee handbook and we don't want to get in the middle of the employee handbooks, go home.

0:57:06 Thomas: Gotcha yeah yeah yeah that's interesting okay

0:57:19 Jenessa: Same guy. Now they have also quit. They're starting a competing business.

0:57:23 Thomas: The guy has quit you say they the guy or his employees Oh, they all quit. Okay. Gotcha.

0:57:26 Jenessa: He quit and those employees have also quitted. They all quit except his former secretary still works there.

0:57:33 Thomas: Hmm.

0:57:33 Jenessa: And he says, can we, and she knows full what, she's planning to quit eventually too. She knows what they're going to do in this system. So nobody's like, it's not phishing. It's not anything that you could even try to act like is hacking. Hey can we borrow your password that you you have a password you have authorized access to the system we've been asking you to get the information I have a really complicated request can I just have your password to go in there and get some stuff and she goes sure and gives it to him that is without authorization not exceeding authorized access not allowed with and what they said And essentially what they said was he tried to argue, I didn't pass a firewall, I didn't steal a password, I didn't hack. This is a hacking law. And they said, no, my friend, you were not authorized.

0:58:08 Thomas: Okay, okay. Yeah, interesting. Go ahead. I think I totally agree with this.

0:58:25 Jenessa: Yeah, I mean, I do too, right?

0:58:26 Thomas: This is the same as stealing a password. If you essentially give somebody a bullshit reason or you kind of are dishonest and you... To me, I would look at that as not much different from phishing for someone's password. You've sent a fake... Let's say you've sent a fake tech email and a fake it email and you're like hey um need you it needs everybody's password whatever and someone falls for that that's kind of like pretty similar to me so I feel like that I actually that that decision makes sense to me

0:58:56 Jenessa: The only thing I find a little arbitrary, if they had asked her, and they had on multiple occasions, hey, sneaky sneaky, go log in, get us this information. They said that doesn't exceed exceed authorized access. We're not getting in the middle of this bullshit. The second she was like, I'm sick of doing your dirty work. Here's my password. You do it. That was without authorization and a crime. And he got like a year and a day in prison.

0:59:02 Thomas: Wait the first thing wasn't you said the first things wasn't exceeds authorization or did you mean the first thing wasn' without authorization

0:59:30 Jenessa: The first thing they tried to say, you were exceeding your authorized access, so you used your password to go into the system like you normally are allowed, but you did a bad.

0:59:38 Thomas: Because he's liable for what the secretary's doing Yeah.

0:59:41 Jenessa: Correct. Yeah, you do have to remember, even though he he didn't do it, accomplish liability, act like he did it.

0:59:47 Thomas: Interesting.

0:59:47 Jenessa: So, because accomplish liability when you direct someone to do it.

0:59:50 Thomas: So maybe that messes up the point I was making, because if I'm trying to make the point that, hey, this is similar to like fishing, when she gave him her password, we're still saying that the conduct we're analyzing is what she did or what he did with the password that he got. OK, so then never mind my points, my point stands.

1:00:06 Jenessa: In that case, it's what he did with the password. Yeah, yeah.

1:00:13 Thomas: OK, I just want to make sure because I thought for a second I might have been analyzing the wrong thing.

1:00:15 Jenessa: No, no, you got it.

1:00:16 Thomas: Being liable for what she did. What was that conduct specifically again?

1:00:20 Jenessa: If she, still an employee, uses her login and password to go to a place she's normally allowed and gets information, but she's passing it to a former employee and she knows she's not supposed to. Totally legal under the CFAA. She's not exceeding authorized access.

1:00:31 Thomas: Gotcha. Yeah, that's based on the same as Amy Coney Barrett's logic, right?

1:00:40 Jenessa: It's pre that decision.

1:00:41 Thomas: Right. But the point is, it is that logic. Okay.

1:00:44 Jenessa: Yes, it's that same logic. The second she said, I'm busy. Just take my password and you do it. That was without authorization and a violation of the CFIA. So it's the exact same action. It's one step removed, essentially.

1:01:00 Thomas: Well, actually, I think I get that. I think that makes sense, though, because if it's like, hey, take the officer in our example. And if he was like, I don't want to do this, but here, I'll give you my password. You log into my computer, non -police officer, and you do it. I think that, yeah, it's like, OK, that's you're violating the computers. You shouldn't be doing that.

1:01:19 Jenessa: You definitely Definitely are, right?

1:01:19 Thomas: You're unauthorized. Yeah, well, so I guess I don't see what the issue is. Maybe I'm missing your point with this.

1:01:24 Jenessa: It just feels a little arbitrary to me because it's the exact same action with the exact same login, and the person voluntarily gave it to you knowing what you were going to do with it. It's just, if they did it for you, the exact Same Action, the Exact Same Outcome, it just goes from legal to without authorization.

1:01:45 Jenessa: Like, we bypassed Succeed Authorized Access completely. It feels a little silly.

1:01:49 Thomas: I don'T think I see it that way, because I think the difference if we're talking about, again, a sort of a hacking thing, the difference between like, well. I'm taking the stuff I am allowed to access, but I'm just doing something bad with it. That's more of a policy crime or like a like a workplace policy problem and not necessarily like a crime crime and it but if I'm like hey I'm giving you my password and you don't work here if a CIA agent tomorrow is like Thomas here here's my password you do whatever you want here I know like no I'm not supposed to do that I shouldn't be I shouldn'T be doing that I'm guilty of computer crimes if I do

1:02:24 Jenessa: And what's weird is they aren't. Under Amy Coney Barrett's interpretation of the CFAA right now, they're not. I'm sure they're guilty of something.

1:02:28 Thomas: That they're not I thought we weren't even talking about that person

1:02:37 Jenessa: Yeah, we're not talking about the secretary. Correct. You're correct.

1:02:40 Thomas: Okay all right so that's an interesting case

1:02:43 Jenessa: Yeah. The point of this is to define the scope of without authorization as huge. Without authorization does not mean hacking. It means being in a place you're not supposed to be in. It does not require that you fish. It does Not require that you lie about what you're doing. It just requires it's they said it's defined by the employer. The employer defines who's authorized. They try to argue, like, the secretary's authorized and she gave me her password, which authorized me. Like, absolutely not. Get out of here.

1:03:08 Thomas: Hmm right yeah no no that like wouldn't be any different than if you just found someone's password that's a bad argument

1:03:16 Jenessa: We've got in here section A2. This is what our guy in Van Buren got. Intentionally accesses a computer without authorization or exceeds authorized access and thereby obtains, A, information contained in a financial record of a financial institution or blah, blah, bla. B, information from any department or agency of the United States. That's him. He got an FBI database. That's what they tried to get him for in Van Buren.

1:03:43 Jenessa: Or C, information from any protected computer. So this is the one that's super broad. Something I saw some people get confused about. It is an intent crime. Intentionally accesses. There's a bit of a circuit split on do you have to know you're not supposed to be here? Some circuits seem to express concern of like what if this is a general intent crime and you're just you intended to be there not you intended to Be a place you're not supposed to be like you didn't we

1:04:09 Thomas: Not you intended to break the law it's the difference between like oh whoops I accidentally clicked a button I didn't realize it took me to this area that I'm not supposed to be versus no you're intentionally there but you're not thinking I'm here to do crime stuff you just didn't know that you weren't allowed to be there. Does that distinction make sense?

1:04:28 Jenessa: Have to separate out like three kinds here really so there'd be general intent which is I intended to click the buttons to go there specific intent would be I intended To go a place that I knew I wasn't supposed to Be in what you definitely everybody agrees you don't need for section two here that you had a nefarious purpose, that I was going to do something bad. It's just very simply, I know I'm not supposed to be in here. And that's why there's this concern of overbroadness, that if he goes into that license plate database out of idle curiosity, under the original interpretation of the 11th, the 3rd, the 5th, that would be enough. You know you're not supposed to be be in there for idle curiosity.

1:05:14 Jenessa: And also the without authorization. If you hacked into the database, if you discovered it wasn't password protected, but you know, you're not supposed, you know you're Not supposed to be in There. But you had no nefarious intent whatsoever. Doesn't matter. Two is the most broad. It's also almost always just a misdemeanor. So I mean, not that that's great, right? We'll give you another one here. Four is more the escalation of that.

1:05:39 Thomas: Sorry. What's four?

1:05:41 Jenessa: We're still in like 1030A, we were in 2, now we're in A4, knowingly. And with intent to defraud, access is a protected computer without authorization or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the computer, computer the use of the computer and the value of such use is not more than five thousand dollars in any one year period that last bit my understanding is just like to avoid the government being like aha you obtained a thing of value you used the computer and it's like all right they're

1:05:44 Thomas: Oh, gotcha. Okay. Yeah, that sort of sounds like the Gmail thing, kind of, like a little bit.

1:06:26 Jenessa: Trying to couch them in and go okay if the object of the fraud was the the use of the computer and you got a dollar's worth of value no no no no, no, so this one is an escalation. You had intent to defraud without authorization or exceeds authorized access. Okay, here's five. It's got three parts. A, knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct intentionally causes damage without authorization to a protected computer. So those two sections, we have examples without authorization or exceeds authorized access notice this with five they will only talk about without

1:06:30 Thomas: Mere use. Yeah. Okay, yeah.

1:07:14 Jenessa: Authorization okay so we got an a b and c a knowingly causes the transmission of a program information code or command and as a result of such conduct intentionally causes causes damage without authorization to a protected computer. B, intentionally accesses a protected computer without authorization, and as a result of such conduct recklessly causes damage. Or C, intentionally access is a protected computer without authorisation, and has a result of such a conduct causes damage or loss.

1:07:53 Thomas: Sounds

1:08:00 Jenessa: This is hacking.

1:08:00 Thomas: Like designing viruses and different level of intent of you putting them on the computer yeah and like it's it seems like it saying even if you design a virus and you don't personally get on a computer and launch it you're still kind of

1:08:08 Jenessa: Exactly. So A is like I meant to cause damage or like I meant to upload a program and that caused damage, whatever. B is I access it and recklessly cause damage. And then C is saying like, just to cover all our bases, I don't care if it was an accident. You accessed it and as a result of such conduct, so essentially like the method of access, cause damage, or loss. So presumably like data loss, right?

1:08:27 Thomas: Liable so just to make clear does that mean if you just accidentally like got a virus

1:08:41 Jenessa: I do wonder that. So like under C, I think it's possible if you, without authorization, get in, access a protected computer without authorization.

1:08:54 Thomas: You do still have to be in the in the computer without authorization oh okay okay

1:08:55 Jenessa: That's going to be part of all three.

1:08:57 Thomas: Gotcha I thought the program was okay got you okay Okay.

1:09:00 Jenessa: Oh, yeah, yeah. No. So this isn't getting a virus on your computer.

1:09:03 Thomas: Gotcha.

1:09:03 Jenessa: This is one way or another, either intentionally putting it on somebody's computer through recklessness as part of your access, this causes damage, or just by virtue of having access to it, you cause damage or loss.

1:09:19 Thomas: Oh, okay. So it isn't necessarily though, like you designed a virus or, and got someone to mistakenly put it on their computer necessarily.

1:09:29 Jenessa: Yeah, I think A would certainly cover that. And A is contemplating that.

1:09:33 Thomas: Remind me what it is. Cause I thought you said they all had the accessing a computer.

1:09:37 Jenessa: A is phrased very confusingly because it mentions without authorization at the end. Knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization to a protected computer.

1:09:55 Thomas: Okay. Uh, yeah, I see what you're saying.

1:09:57 Jenessa: It's not damaging any old computer. Without authorization to A, protected computer is going to be all of them, basically. Yeah.

1:10:04 Thomas: It's going to be all of them. Is that because they, that used to just be the government ones, but then they kind of added also in the, like any computer.

1:10:11 Jenessa: So the amended thing, a protected computer is going to be interstate commerce, which is connected to the Internet.

1:10:17 Thomas: Yeah. So So it's kind of, so that's kind of useless now. Like that just basically it's any computer.

1:10:22 Jenessa: Pretty much like if I did something to my personal computer while it wasn't connected to the Internet with no risk to anybody. No. But as soon as it's engaged in interstate commerce and I, you know, I think there'd be a presumption you'd have to I guess if you were messing with your own computer and you like destroyed the whole Internet, that that could count. But generally, yeah, without authorization to a protected computer. The other two, I think, really, they should have all just started with this to make it clearer.

1:10:53 Jenessa: B and C both start with intentionally access as a protected supercomputer without authorization. And as a result of such conduct, B is going to be recklessly causes damage. C is going to be just causes damage and loss. So they're trying to hit all their bases. Either you You meant to destroy a computer as part of accessing the computer. You recklessly damaged it or as part of accessing the computer you damaged it.

1:11:19 Thomas: Gotcha. Okay.

1:11:20 Jenessa: We don't care. It's it's the act of access. Why does this not say without authorization or exceeds authorized access?

1:11:28 Thomas: Hmm.

1:11:29 Jenessa: If we read Barrett's definition, so without authorization, she doesn't define it in Van Buren, but without authorization from the case law just means means anybody accessing who's not supposed to be there. And she's saying exceeds authorized access means you do have access to the computer. You do not have access to, she says, areas in the computer, such as programs, folders, or files.

1:11:55 Jenessa: Essentially, that kind of leaves us with unauthorized people are outsiders, exceeds authorized access are insiders.

1:12:03 Thomas: Yeah. Kind of. Yeah.

1:12:04 Jenessa: I struggle to imagine Imagine all alternatives to that. And that kind of matches from a computer security standpoint, like there is a meaningful difference from an outside attacker who's not supposed to be in here and an insider who like has access to parts and then does this like privilege escalation, like, you know, finds a bug to let them get someone else's login or whatever. Whatever, it's meaningful in a computer security sense that you do have different way, like those are different attacks. They require different methods to protect against them. So, okay, hypothetically makes sense, right? But why would Congress mean it to be this, that if I got on a computer I'm not supposed to be on, and without authorization, we've said is like, I could just get on there because you forgot to password protect it.

1:12:54 Jenessa: And then in order to get into a file, I upload some malicious program I damage the computer I'm in big trouble this is way worse than part two where I just accessed without authorization I got information I wasn't supposed to get real bad but I part five also I damaged the computer I'm in bigger trouble the exceeds authorized access person they're allowed on the computer and they're not allowed out in the file.

1:13:25 Jenessa: If they get on the computer, upload a malicious program, destroy the computer. Congress didn't mean Part 5 to apply to them. They weren't supposed to get in trouble for that. Because 5 just says without authorization. It does not say exceeds authorized access. And all the other ones do. Well, four of the seven do.

1:13:48 Thomas: I get what you're saying, But I also feel like if we were trying to write part of the law that applies to like viruses, essentially, I feel like the times where that's going to be an exceeds authorized access is like never.

1:14:04 Jenessa: This is actually a really common common form of attack is that somebody who works for the company gets access. They have login credentials. I talked to a friend about this who's a software engineer, and he confirmed some of this that, yeah, like that privilege escalation is a really common form OF attack that

1:14:07 Thomas: How? In order to upload like a virus or something? Because it's covered if you do anything that is already a part of this case where you like access a file, like see a file or change a file. Yeah. Then you're definitely already covered.

1:14:30 Jenessa: You're not supposed to or you're definitely exceeds authorized access for part two. But for part five, where you would get in even more trouble because you damage the computer, they write without authorization and they do not write or exceeds authorized access, which they did do in four out of the seven parts.

1:14:52 Thomas: Yeah. I guess what I'm saying is maybe if you've talked to someone, sure. But I'm seeing like in terms of Congress and their intention, I could absolutely see them being like, that doesn't make any sense. If you, if you were authorized into this system. So you're saying there's just like a bunch of people who in their own company, they work at try to put a virus in there. Does that happen? Like a ton?

1:15:00 Jenessa: This is a common form of attack. You had login credentials to get into a system, but you did not have permission to get in. I have that. I don't have that permission to get into most of my work computer. Sometimes I get a thing that says you need an admin password. Word. This is a common form of attack.

1:15:33 Thomas: It's common that people like you are uploading a virus.

1:15:35 Jenessa: Not like 90 % of people would do this. Not like I would do this.

1:15:40 Thomas: No, I just want, I don't understand. This is confusing. So I want to make sure I'm understanding the thing you're talking about.

1:15:45 Jenessa: It could be, or it could be plugging in a USB that has a malicious program. When we say virus, like people are thinking of like old school virus that is like, haha, I damaged your computer on purpose. But it could also be a program that just helps me get into another part of the computer, which which could conceivably damage something or cause data loss, keep in mind for part C, that could be an unintentional consequence of it, that you access a part of the protected computer without authorization and as a result of that cause damage or loss. So maybe your intent was not to upload a virus and ruin a whole system, but you upload some malicious program that would help you access things. And in doing so, some data loss happened, some damage happened. 5A, B, and C are all covered in this.

1:16:39 Thomas: But in order to be exceeding your authorization, this has to be like an employee of the place, right?

1:16:45 Jenessa: Yeah, and what I'm being told by computer security people is that is common. A lot of people in our comments are saying their thought of what unauthorized and exceeds authorized access should differentiate is people who are not supposed to be be in the computer at all and people who are supposed to be in the computer but then engage in a privilege escalation type attack.

1:17:07 Thomas: Yeah, no, I got that. Well, type attack, I guess, I don't know about attack. I haven't heard of that. I guess what I'm saying is like, it might be true that this happens, but I also, I might be just misunderstanding, butI could very well imagine this being something that Congress was like, well, no one's going to upload a virus on their own company computer. That doesn't make any sense. So like they didn't worry about the exceeds access because they were looking at the war games type thing that you said. I'm just saying that seems like possible to me, but maybe I'm misunderstanding you. Okay.

1:17:37 Jenessa: Think about a government worker. They're concerned about because this is what I really think is going on. I don't think that makes any sense that you would say if you exceeds authorized access and do this, oh, you're fine. You didn't do anything wrong. Here's what makes way more sense. Why is part two the one that feels like it should be the lowest level offense here

1:17:57 Thomas: I think I need to like, look, can you send me this? Cause I don't, I can't track what you're saying. Okay. Got that.

1:18:01 Jenessa: I'll give it to you just scroll down to criminal offenses under the act this is the text of the law so when we look at this here part two is like the part in Van Buren it's the broadest the easiest to violate you without authorization or exceeds authorized access you just go in here and you get information you don't have to have nefarious intent doesn't have to be in combination with another crime whatever shouldn't that be part

1:18:27 Thomas: Gotcha. Shouldn't be part one.

1:18:30 Jenessa: One why wouldn't that that be the first crime is the easiest to the most baseline crime and then everything else builds on it. It's with intent to defraud, with intent to extort, blah, blah.

1:18:40 Thomas: Oh, I see. So usually they start with one thing and then kind of build off of it.

1:18:44 Jenessa: Yeah. Point is these are all under 1030A, lowercase a, and then we have one through seven are ways to violate this act. Criminal offenses. There's civil offenses too. So the first way to violate it, the most important to us unauthorized disclosure for reasons of national defense or foreign relations you got information of the atomic energy act you communicated or delivered they're worried about russian spies

1:19:12 Thomas: Or just any federal worker using their, yeah.

1:19:15 Jenessa: Sure it encompasses a wide range of things but like when people are saying like this law is about hacking this law's about the red scare this law Is about panicking that you're gonna give stuff to russians and So what I think is worth noticing here there's four of them of the seven say without authorization or exceeds authorized access. There are three that only refer to without authorization. The distinction between them that you could rationally draw, it doesn't fit these ones are only outsiders and these are things that both outsiders and insiders could do.

1:19:52 Jenessa: The without authorization, or exceeds authorized access, those ones are about getting information you shouldn't have and then either giving it to people or using it for fraud or using it for extortion or giving it to foreign actors, national defense. They're about the having of the information. The ones that are just saying without authorized access, they're not really distinguishable as only an outsider could do it. It's more about an insider could also do it, but not with permission. So really, if you have password access to the file, why would you upload a program that could damage the computer? You'd just use your password and go in. There would be no reason to add exceeds authorized access. If we understand without authorization means people who hack, people who are not supposed to be here. And exceeds authorized access is, hey, my system is only as secure as the people I trust. I am worried about government employees who are going to give away our secrets. So when I give you access to the tax department and I say, okay, my friend, today is a big day, here's your password, you can use this for your job. You cannot use this for anything outside of your job. Are we clear? Major violation of a federal law. Do not do this. You need this deterrent because no amount of computer tech security in the world is going to solve the problem of I trusted somebody I shouldn't trust. So this makes so much more sense in that context. Without authorization are people who hack things, and people who hack things could damage your computer. People who exceed authorized access are people are allowed in the computer, in the program, but I'm scared they'll get this information and give it to God knows who, or do something bad with it, or on section two here, I just don't want you doing this. This is not kind you work for the tax department stop looking up your ex-girlfriend if you take it from that perspective which multiple circuits did before Van Buren it just fits with this and if you look at it from the other perspective it just kind of doesn't why some of them are only without authorized access and not intentionally without authorization access is a non-public computer that belongs to the government or is exclusively for the use of the government, why would they not want to get the person who exceeded authorized access to a government computer? They would want everybody, unless exceeds authorized access means, no, that's the other sections where you weren't supposed to get the information. This is the section where anybody who's not supposed to be on the computer got on the supercomputer. Anybody who wasn't supposed to be in the system got in the system. So I think it just makes so much more sense to say, you know, from a techie perspective, a person who's not supposed to be in the computer is different from a person is supposed to be in there, but then does other, you know, finds a way into a program. From a legal perspective, they're all unauthorized, whether they were unauthorized to get in the computer or unauthorized to get into a program on the computer. We have different levels of security, different levels of security clearance. And some of these people are trusted. I'm worried about them exceeding the authorization. Other people are just not authorized, whether they're not authorized on this computer or they're authorized into that database. It just fits better. Without authorization is punishable for damaging the computer. A person who is allowed to log in because I gave you a password how would you damage the computer that way then it fits yes

1:20:06 Thomas: I thought that was what I was saying though. When I was asking, like, is it a problem that a lot of people, okay.

1:24:06 Jenessa: Especially think government systems that somebody you gave a they can come in the building they can log into a computer that is on the wi -fi and blah blah exploits a bug in a program to get somebody else's login who is has higher security clearance or something like

1:24:20 Thomas: Man,

1:24:28 Ad: [Ad break 4 — ad music]

1:24:28 Thomas: I wish I had any idea of the point you're making. I'm trying to understand. First question I have and something I'm maybe not getting is in the arguments, they talked a bunch about, well, this used to just be government employees and now it applies to like everything everywhere. And so I'm not sure where and how did that happen? Because Is it like when I look at this language, there's like a mix of like, well, it's the United States government, Department of Energy, whatever.

1:24:51 Thomas: And then other times it seems like we're talking about any computer of anyone. Like if I hacked your computer and you're not a government employee at all.

1:24:51 Jenessa: That mm -hmm

1:25:02 Thomas: OK, but only some sections. Right.

1:24:58 Jenessa: Sure yeah there's some sections that would apply yeah so some of them are saying like it's extra part three it's extra bad to get into a government system you're not supposed to be in that's one offense part four knowingly and with intent to defraud getting into a protected computer so let's compare like two and three to intentionally access a computer without authorization or exceeds authorization and thereby obtains certain kinds of information. That is without authorization or exceeds authorized access.

1:25:38 Thomas: And by the time you get to see of that one to see it says information from any protected computer, doesn't that just mean anything like literally anything? Anything.

1:25:45 Jenessa: Yeah, so it's anybody. Pretty much any computer.

1:25:49 Thomas: So we started with like financial, whatever, but like by the time you get to see, it's like, well, why even bother with those details? Because it's just like literally any bite of information, then it already like counts.

1:25:57 Jenessa: In the 80s, maybe not every computer was on the internet. So protected computer is interstate commerce, which kind of requires the internet. Nowadays, it's everybody.

1:26:14 Thomas: So like at the time, you're saying there might've been distinctions here, but as the internet developed, functionally, A, B, and C don't really matter. It's just C pretty much matters.

1:26:22 Jenessa: Yeah pretty much. You could also imagine like air gapping and stuff that there are information from any department or agency of the United States, you could have something super secure that isn't connected to the internet and we want to cover that.

1:26:33 Thomas: But that would already be a protected computer, right?

1:26:38 Jenessa: Protected, it was defined as interstate commerce.

1:26:42 Thomas: Oh, so you're saying once it is not just like government computers, if I right here, it was like, I have my computer that is my super secure, whatever. And it's, there's not on the internet, but you still find some way to get into it. You're saying that protects that somehow?

1:26:58 Jenessa: So no. So like if it's not, protected computers involved in interstate commerce, let's say you have your personal computer that is like purely for home gaming and you like, I don't know, somehow you never connect it to the internet that would just actually I think not be covered here uh at least under two at least under this part two here imagine similarly a government agency has computers that operate kind of that way they are for security purposes like totally air-gapped we never get on the internet um election stuff is often this way um you may you know like if you need new software you plug in a usb like you don't go connect would that be a protected computer would that be interstate commerce? Or do we need this Part B to cover information from any department or agency of the United States?

1:27:14 Thomas: Not. Okay, gotcha. Okay Okay.

1:27:49 Jenessa: Hypothetically, it's not complete overlap.

1:27:52 Thomas: Oh, I see what you're saying. So my example didn't work because I'm not government, you're saying it would need to be a government thing in order to be air-gapped and not a part of any interstate commerce technically, but still qualify for this. Okay.

1:28:05 Jenessa: Yeah, yeah. If it was from a department or agency or this financial record or financial institution, if your bank did an incredible job of never being connected to the internet and you still got in, no.

1:28:15 Thomas: Okay, so this is about making sure, despite however the Supreme Court throughout history is going to interpret the interstate commerce stuff, it's kind of still covering all your bases. Okay? So that makes sense to me.

1:28:23 Jenessa: Yes. Regardless of how we interpret interstate e-commerce, banks and the government will always please be a place where this covers.

1:28:31 Thomas: Okay so that was two and you wanted to compare that to three I think

1:28:36 Jenessa: Yeah, sure. So two, without authorization or exceeds authorized access, you get this information and the mere act of getting the information, no, bad, slap on the wrist. Three, intentionally, without authorisation, never says exceeds authorized access, access any non -public computer of a department or agency of the United States, read or into here, there's three clauses, or accesses such a computer of that department or agency that is exclusively for the use of the government of the United States, how the hell those are different, I don't know, or in the case of a computer not exclusively for such use, is used by or for the government of the united states, and such conduct you're accessing, affects that use by or for the the government in the United states.

1:29:25 Jenessa: Why doesn't this include exceeds authorized access? If exceeds authorized access under Barrett means you are allowed on the computer you're not allowed in that file why would we not include this in a violation of going on government computers why would that not matter as we're going through this list we are often escalating in the level of punishment

1:29:45 Thomas: Think I understand why three is even different from two three feels like it already is two what's the difference

1:30:12 Jenessa: I guess you could I'm still gonna keep

1:30:14 Thomas: Oh well couldn't that answer the question that they would want to punish these outside users more like because if you're already covered as an exceeded authorized access by two maybe three is like and extra punishment if you're not you have no business being here but you've hacked in okay what's five

1:30:17 Jenessa: Getting hung up on five so five is the one where Where you intentionally or recklessly or totally on accident damage the computer while you're accessing it.

1:30:26 Thomas: They only bring excess of authorization back in like 7B or something. Is that what you say?

1:30:31 Jenessa: Yes. So it's been coming in and out. It was there for 1, 2, 4, and 7B.

1:30:37 Thomas: 7B seems like with intent to extort from any person. So that kind of brings purpose into it, which is interesting.

1:30:44 Jenessa: Yep. And 4 is with intent to defraud. That's got purpose. 1 has purpose in the sense of like you're going to get this certain very sensitive information. You might transfer it. We're worried you're going to transfer it to somebody. I don't think it requires it. 1, 2, 4, and 7B are all about taking information and possibly, you know, 2 doesn't require this, but like doing something with it that is concerning. It's all about getting the information. Information three is about you accessed these government computers or if it wasn't exclusively a government computer your conduct messed with the government five is you damaged the computer and six is like selling passwords if without authorization included somebody who's an an insider but is doing malicious stuff where they are cracking and hacking it would make sense that you would say yeah like you could sell your password to somebody with less clearance than you so they have without authorization why would you say I if I sold somebody who would be accessing exceeding authorization oh now nobody's in trouble doesn't make sense

1:32:08 Thomas: By that logic, I could sell a password to someone where they had authorization, but just increases their authorization.

1:32:16 Jenessa: Yeah if it was an an insider who's allowed to access the computer, but not a program in the computer like Zoolander style, I could sell them the password that would allow them to access it exceeding their authorized access. And somehow that's, Congress meant that to not violate this? Or is that exactly what they were worried about? That people would, especially working for the government, that they would escalate their access by, I made such a dumb mistake by letting you in this building, spies. Why would you punish me for selling the password to a person who's not supposed to be in the computer at all, but not to aperson who's allowed in the computer but not on that program?

1:32:59 Thomas: I see your point, but I'm not sure how that the Amy Coney Barrett way messes that up. But whatever the other way wouldn't mess that up.

1:33:08 Jenessa: If without authorization means, I don't care what level we're at. Accessing a computer you're not supposed to access, accessing a program, a server, whatever. Insider, outsider, doesn't matter. Accessing stuff you're not supposed to assess ever, that's without authorization. If exceeds authorized access is this concern that a person who works for the tax department who's allowed to go to those records, a person Who works for The CIA, who's a loud to look at this, might then then give it to somebody else, use it for fraud, use it for extortion. Now I'm worried about both people. I'm worrying about the hacker, I'm worry about the outsider, I worried about the inside hacker, and I'm just worried about just the guy I trusted like an idiot. But if the guy I trusted has a password to get in here in the first place, they're not going to damage the computer by typing in their their password. Only the person who has to upload a malicious program to access something under 5 could possibly damage it. So this just makes so much more sense if without authorization, if I am allowed on my computer, but I access a file I wasn't supposed to access, aren't I just without authorization? Why does that have to be exceeds authorized access?

1:34:31 Thomas: How does that not run into the same problem where I don't understand, then I don'T understand why everything isn't just without authorization. Like what would actually, in your view, fall under exceeds?

1:34:41 Jenessa: Exactly what Van Buren did. He had every right to be on that computer. He has every right to be in the license plate database in general he had a password he didn't have to hack anything it would be a scope thing that all these many circuits were doing for decades that the supreme court actually denied cert on a nearly identical case about uh nine years earlier left it

1:35:08 Thomas: So without authorization would be

1:35:10 Jenessa: Alone for almost a decade before van buren anytime you're not supposed to be in a place.

1:35:13 Thomas: Defined not supposed to be. Why isn't the officer also violating that?

1:35:18 Jenessa: He would be exceeding authorized access because he has a password into the thing. We have allowed him in there, but he exceeded his scope. The without authorization person was not allowed in there. So the without authorizationperson, we can try to stop them with technological barriers. The exceeds authorized person who is allowed in this system, and I just have to trust you deeply to not be like the guy that they denied cert on uh like just looking up people's addresses because he worked for the irs I just have to trust you not to do it there's not a technological barrier that stops that very well because he has password access to the system yeah

1:36:03 Thomas: So you're saying when they denied cert, so that means that person was using a password to access stuff, but doing bad stuff with it, and they were convicted of the exceeds authorization, they appealed and no go.

1:36:15 Jenessa: So they were in the 11th circuit also so like identical he worked für die irs oh my god this guy's like peak scumbag he like meets a woman in a bar and then sends her flowers and she's like how the how did you get my address he like sent her a letter that had her middle initial and she's Like, I have not used that since grade school. How do you know this? Like he was creeping on people. He accessed his like ex girlfriend's daughter's account like 22 times or something crazy like that. And he didn't steal money or do anything too wild, but he was just creeping on so many women by accessing their tax information. They even like every year they have people sign a form that's like, I understand that I am allowed to access this information for purposes of my job and not for non -business purposes. And He literally said to his boss, he refused to sign it. Why didn't you just fire him because he refused to sign it he said why would I give the government rope to hang me with and didn't

1:37:19 Thomas: So, but that didn't work for him?

1:37:20 Jenessa: Sign it uh no no not signing it did not save his life because also every time you open the program a pop -up came up that said like I solemnly swear I'm just so you know you have to use this

1:37:32 Thomas: That's interesting. That could be different. Does that happen with the officer?

1:37:35 Jenessa: I don't know actually they didn't mention it whether he was like the The on notice, I'm sure, helped that every time he opened this program, it said, you can only use this for business. Just as a reminder, the IRS is on top of their shit, you know? So this was the 11th Circuit. This was 2011. Van Buren was argued in 2020. They said, You're exceeding authorized access. Yes, you had every right to be in that database. There was no hacking, no cracking, no, even like just by word of mouth, you're not supposed to be In this program. He's supposed to be IN this program! He's supposed to look up those files when people call and say, help me with my taxes, please. But he was obviously not supposed to look up his ex -girlfriend's daughter's tax return.

1:38:20 Jenessa: And he was convicted on that, and he appealed to the Supreme Court, and they denied cert. Now, denying cert does not make it the law of the land.

1:38:27 Thomas: It also could have to do with what they decide to spend their limited time on. Doesn't necessarily mean an endorsement of that view of the law per se, but I do see what you're saying.

1:38:39 Jenessa: It's like meaningful -ish, you know? It left it intact. In the 11th Circuit, it remained binding precedent for another decade until Van Buren came up.

1:38:52 Ad: [Ad break 5 — ad music]

1:38:52 Thomas: So under this idea, unauthorized means you don't work here and that's it?

1:38:59 Jenessa: Or you do work here, but you know damn well you're not even supposed to be in that program.

1:39:03 Thomas: Well, sorry, wouldn't that be exceeds authorization then?

1:39:06 Jenessa: No, they had been defining without authorization as like the classic hacker and keeping in mind that insiders hack. It would be exceeds authorization was a very narrow group of people who had every right to be In The Place and to look at the files, but not with that scope of of authority.

1:39:29 Thomas: Sounds like or not with that purpose.

1:39:31 Jenessa: Not for that purpose. Yeah, yeah. When we say scope of consent, yeah, read purpose for that reason. So that would be the point is like without authorization. Think about it this way. Like now that like so many computers have like networked drives and everything and things are on different servers, like when they say something is like, again, it's Barrett. She's not, you know, these are not the nine greatest experts on the internet. What is a place in the computer I'm not supposed to go, does that include the mapped network drive that's so far away? Is that a place in my computer?

1:40:04 Thomas: Well, but that has been amended to be like any place in any computer, though.

1:40:08 Jenessa: You have to be allowed in the computer but not a place in the compu -

1:40:13 Thomas: Yeah. So you get you have credentials to get into your work computer, but you go on a network drive that you're not supposed to be on.

1:40:20 Jenessa: Is that exceeds authorized access or without authorization?

1:40:23 Thomas: I would think that succeeds authorized access.

1:40:26 Jenessa: I think what I'm getting at is like it starts to break down eventually. The sensibleness of this starts breaking down when it's like well by virtue of being on this computer and then hacking, I can get into other stuff. It just doesn't hold up as well as saying you need an admin password on my work computer. I'm just not authorized to go there. Why is that exceeding authorized access if I hack into that by uploading a virus? I'm not authorized to go There.

1:40:58 Jenessa: Exceeds authorized would be I am allowed to go into client files for my job. I am not allowed to steal those and give them to the Russian government. God knows why they want it. That's how many circuits had defined. This is not just me making this up.

1:40:58 Thomas: Why would you need that necessarily as a computer thing when that could already be? I'm sure there's plenty of laws against that if they were just paper files that you were giving to the Russians or something, right?

1:41:25 Jenessa: So that's Sotomayor's argument is, isn't this stuff already illegal? Won't there be bribery? Won't their be trade secret theft? Like, and I think that's a good argument is like, if you want this to be illegal, make it something else. That's not a good reason to think that that's not what Congress meant.

1:41:43 Thomas: Well, I think I am asking you why that isn't what Congress meant. Why couldn't Congress have thought this is already something, so we're punishing a certain group of computer crime? Yeah, I guess I'm just not understanding that part. In the end, to round this out, the previous view that you're saying that some circuits had that would have worked fine is that this officer was exceeding his authorized access by virtue of using it kind of for stuff he shouldn't be using it for.

1:42:17 Jenessa: Yeah. Yeah, he had a defined scope of access and he exceeded it.

1:42:21 Thomas: I wonder if what's happening is granted this law is old and the wording is not perfectly mapping. I think we can all agree it's not mapping onto current reality very well. And so it's kind of like, how do we map it better or worse? And I I wonder if the concerns over, well, if authorized access isn't tied to specifically like, you know, passwords or whatever, and exceeding authorized access is not in some way tied to something very tangible and not just like, again, if the boss had said, hey, don't do that today, do that tomorrow, does that mean I'm exceeding my authorized access if I access it today? And and I think they looked at that and thought like that's a little bit too loosey -goosey to like be guilty of a computer crime of very serious computer hacking crime I

1:43:11 Jenessa: Yeah, certainly. And I think what a lot of opinions in other circuits or dissents to this, you know, the Ninth Circuit dissent addressed this as saying, hey, first of all, you can wait until that comes to us and do an as -applied challenge. So, like, as opposed to the whole law's always unconstitutional, as - applied challenges say when you try to use it for this purpose. Now, obviously, the defense attorney side of things is going to be, yeah, and in the meanwhile, my client sat in jail for years while this came to you. So, like, screw that. But that's an option. You know, one of the dissents was like, hey, you guys are going through all these, like parade of horribles, all these hypotheticals that are not in front of us. Like, why are we doing this? I think those concerns are totally valid. Like, I'm on board for that for sure.

1:43:38 Thomas: Think the parade of horribles is pretty dumb but but not that I don't think you can sour yeah don't sour the whole argument with the dumb ones I think it is a legitimate concern to be

1:44:01 Jenessa: Not all of them. Yeah, yeah. Where do you draw the line?

1:44:07 Thomas: Like yeah exactly so how would you define and I guess I'll ask you by what measure is that scope of access that scope of like consent to being in here for sure triggered like is it a written policy is it uh

1:44:22 Jenessa: So definitely I agreed with like the way the Ninth Circuit approached it saying when it was a thing with a private employer, I have to agree that like they could write their employee handbook 400 different ways. Like this just seems too loosey goosey, too at risk of like being applied to some people and not others and being like taken advantage of. There's there's case examples out there of this being prosecuted in ways that are like really gross. So like I do not want to be seen as defending this, just to be clear. I think the IRS one made a lot of sense, like a crystal clear articulation of a government policy. Like the fact that it's a government agency feels relevant to me as opposed to like your random employer who could have just written anything into their employee handbook. I don't have an answer for you for where to draw this. I'm like purely talking about what do I think Congress meant and what Congress meant might have been dumb as shit. Like I absolutely think this was like inspired that literally it's on the record. They were inspired by a Red Scare movie in the 80s. Like, this was not the place to base your law off of. It's more just like, I find the scope argument compelling as to what they probably meant. And yeah, I just find it so hard to believe. Like, they wanted to prosecute the person who used some malicious software to get into a computer they weren't supposed to get into, but not the person whose was in a computer that they were supposed to go into and use malicious software to get in to a file they weren t supposed to get into. And if we use Barrett's definition of exceeds authorized access, that is used in 1, 2, 4, and 7b, and it's not used in 5, where you would get punished for the hacking, the use of a malicious program, the damage from that. That just doesn't make sense.

1:46:27 Jenessa: But if without authorization is, I don't care the level we're at. I don'T care if you got into the computer you're not supposed to be in or the program you're NOT supposed to BE in. That's just unauthorized. Then it makes sense. The person who is allowed in the database with their own password doesn't upload a malicious malicious program to get into the thing that they don't have to have to. Yeah, of course. Why would I put that there? You know, it just fits better to me. It makes more sense to me I'm not saying it's a good idea. I think what they did ultimately makes sense. I really would have preferred like again, you know, so to my owner, I got a girl crush. I Really think she would have written more like citing to the congressional record quite a few of these circuit courts are like Like, you want to know what Congress meant? Here's a quote of what they said when they debated the law.

1:47:19 Jenessa: And Barrett just doesn't give me that. And it makes me sad.

1:47:19 Thomas: And that's interesting because it from the oral arguments it seems like there's plenty of that in the record and plenty ofthat in the briefs and all that and they talk about it but I do I do see what you mean where ultimately I do think writing for for several paragraphs on the so thing was kind of a red herring. And now that you bring all this up, it would have been interesting to see a little more contention with that idea.

1:47:42 Thomas: I still am not sure how you're answering the question of like what it needs to be to be exceeding authorized access, like what level of thing. You said something about a private employee versus an IRS thing. I don't get how you are drawing that line in the law.

1:47:42 Jenessa: Yeah, yeah, well, I just think that could be a useful in order to draw a line such that this is not abused. That could be useful line. The Ninth Circuit tried to do that.

1:48:07 Thomas: Sorry, what would be the line then?

1:48:09 Jenessa: So if exceeds authorized access means I absolutely had a right to be in the program. I just couldn't do that my scope was clear. I was not supposed to do that. The Ninth Circuit. So they did ultimately say like no to all of this and went with more of a Barrett kind of definition here. But they were really emphasizing the fact that this is like an employee handbook. This is not a law passed by Congress elected officials who sat down and thought very carefully about what these employees were and weren't allowed to do. Hopefully the IRS, they have their government policy from a government agency about what their employees are allowed to do

1:48:16 Thomas: How do you apply that to the law? How do you play that?

1:48:51 Jenessa: As an option to say, like, certainly if there's anything that should not be covered, it would be that you violated the employee handbook and that's enough. No that was written by some guy like who even knows what that means similar to um the ninth circuit had a decision that came out shortly after violating terms of service absolutely not sure

1:49:15 Thomas: I think then the question is pretend we're just in government employee land, so we're in officer land. How do you differentiate between the handbook says maybe don't be using this for this purpose versus my boss told me don't use this for for this purpose, kind of word of mouth, is it just need to be like documented or something? It feels like a bit of a dodge to be Like, well, private versus public sort of employee thing. Okay, keep it just as a public employee. But what level of thing is exceeding authorization, like word ofmouth, my manager said this, my, you know, or is it the handbook said this kind of thing?

1:49:59 Jenessa: I mean you're definitely running into issues I I don't want to pretend you're not like it it this is ripe for abuse like I think that's where the public policy argument is much more convincing to me than like all of this textualist like what exactly did these words mean I like your example of if the boss said, go do other stuff before you do this, like, geez, I hope that's not covered, right? That would be pretty wild. So like, yeah, I mean, I don't know where I would draw that. And like, I haven't seen a circuit address that.

1:50:32 Jenessa: The IRS case from the Ninth Circuit was very clear on like, dude, you saw the warning every time you opened the, like it could not be more clear. But again, like that's probably also other, I do not know that he got charged with of other crimes but like that's probably also other crimes the one that I find frustrating is quite a few of these the other crime is stalking and it's like oh yeah let me let me really rely on the government to prosecute that one but like at the end of the day it is this guy also ended up pleading to a bribery charge so like he wasn't getting nothing I'm totally on board for the the public policy thing of like, as you're describing, there are too many ways that this could go 100 directions.

1:51:20 Thomas: I'm not even sure I'm saying public policy. I mean, I'm just saying if you're trying to draw a line and you're using the hypotheticals and what it's going to mean to try to draw that line different ways. I'm just, I just think it's like,

1:51:32 Jenessa: Oh, it's entirely possible Congress didn't mean to draw that line and wanted to criminalize a giant pile of behaviors, particularly by government employees, because they were panicking. That's totally possible, and that's like terrible, but that might be what they meant. Or they just didn't think, that's an option. They were just like, yeah, I don't know, we wanna criminalize this, this, this and then that acts this is the thing that ends up at the court all the time accidentally swept in like 400 other behaviors and it's like oh shit now what do we do so yeah I mean like I don't I don't have an answer for that like where's the bottom of exceeds authorized access there's quite a few circuits that drew a line between without authorization and exceeds authorized access that is different from what the supreme court did in van buren where is the top of well Well, I guess there's no top of without authorization. It's just all illegal, right? Where's the bottom of exceeds authorized access? I didn't see anything specific. Well, what I saw was terms of service, no. And Ninth Circuit saying employee handbook, no, for a private company and gave a reason I think was very compelling.

1:52:45 Thomas: I guess the point is you're saying that's the facts of the case that they were doing and they didn't, they didn't broaden it out to like, and also if you, you know, cause that's kind of how courts work as we've discussed in the past. Okay. So that's why you don't exactly have to your mind, like a a bright line there, um, necessarily. Okay. Well, that, that don't, that all certainly makes sense. Yeah.

1:52:54 Jenessa: Yeah, yeah, exactly. They didn't go right. Yeah. Yeah. And now we don't have to worry about it because Van Buren just deleted all of that. I think that's where, like, a lot of people had such a reaction in many directions. A lot of people were like, hey, thank God, because this is being abused. And like, I don't disagree with that. And then a lot OF people are like, are you kidding me? We're so focused on the word so and like, we have this, like scope thing that's been going on in so many circuits, and the 11th circuit said it, and it made sense. And we were all ready for that to be the answer. And especially because of the way Barrett talked about it in the oral argument, and then it's like Barrett's writing the opinion. And it's like, oh, yeah, so it'll be that. And then it's, like, what happened here? So, yeah. I think lots of circuits have written in Barrett's direction in ways I just found clearer, I guess.

1:53:53 Thomas: Yeah, and it does kind of fit the whole conservative Supreme Court justice worldview of like, all right, I'm here to just, I's looking at this with fresh eyes, fresh set eyes. I'm going to kind of write what I think, you know, and, and it does seem to have more of a style of first principles type thing, you know, which, which is definitely something that we both tend to think is like less how how you should do it yeah yeah well that was very interesting I'm not totally sure how I'm editing this down but uh in the end I guess I guess if there's a short answer of this let me know how does supreme court justice Jenessa rule in this case

1:54:15 Jenessa: Frustrating. Yeah! Oh, no. Yeah… oh god I don't even know I'm letting someone else write this I did yeah so to my or retiring energy is exact shahar just being like you write it I'm out i'mout you need practice like no I don' want to I probably would have signed on to the dissent because it was not the winning opinion so I don''t feel bad about it if I was in the stuck position of being the deciding vote I don'T know I DON'T know what I would do because I would feel drawn to the side of the more logical argument feels to me that this was a scope thing but also prosecutorial overreach seems to be a huge problem here I don't know what I would have done I'd have been real stuck don't put me on the Supreme Court I'm indecisive no oh my god the stress

1:55:10 Thomas: All right oh okay I was going to but I guess you don't want it all right fine if somebody Okay. Email in if you want the Supreme Court seat that I was about to give Jenessa. Whatever.

1:55:24 Jenessa: Oh no thank you blech

1:55:25 Thomas: All right. All Right. Well, that was super interesting. A lot of fun. And in the future, we need to talk about bribery and how the Supreme court ruined it. And there's a lot around that. And I just think it was really interesting to hear that be part of the 11th Circuit discussion. I wouldn't have even imagined that this could possibly.

1:55:39 Jenessa: Yes not be the thought that it might even not

1:55:46 Thomas: We should definitely take. I mean, that one is a little more political, but it's still I think that one's so like no duh that it's just like I want to figure out how they justified it, how they broke it, and maybe how we can fix it. So we'll see. Maybe that'll be a case we should go through.

1:56:00 Thomas: All right. Well, thanks, everyone, for writing in and giving us your thoughts on this. It was really fun, really interesting. Do engage with us. I had a great time.

1:56:06 Thomas: Thanks, Jenessa. Thanks, listeners. Don't do any hacking out

1:56:05 Jenessa: Yeah for sure Yeah For sure good talking to you Oh my God

1:56:10 Thomas: There unless you have some level of access, then you're fine.

1:56:12 Jenessa: Oh my God don't touch it hey sneaky sneaky