"The CFAA is intended to target "hackers," not policy violations."
However, they also explicitly write that they're not addressing that distinction (footnote 8 on page 13, to my best ability to parse it). There's some semantic gap between "policy violations" and "improper motives".
"For present purposes, we need not address whether this inquiry turns only on technological (or “code-based”) limitations on access, or instead also looks to limits contained in contracts or policies. Cf. Brief for Orin Kerr as Amicus Curiae 7 (urging adoption of code-based approach)."
I discovered this nuance from Orin Kerr's twitter (the same one cited in this footnote); he says he's not confident he understands this footnote.
I don't know if it can always be avoided, but I think it makes sense for a court to try to avoid the code-based approach.
It seems to be all downside (exploiting bugs will typically be OK because the code said this was OK, even if the people who wrote it never intended that) with no upside (the things rendered illegal already don't work, because code forbade them).
Courts ought to be familiar with the fact that they're present mostly to make decisions about fuzzy things like "Did the accused intend to cause harm to the victim?" and not simple mechanics like "Does being injected with cyanide kill people?".
I agree, I don't think it can always be code-only. If you socially engineer someone into giving you an account, I really think that should be fraud.
I've thought about this for some years now and looked at various different cases tried under the CFAA or otherwise claimed to be unauthorized access.
I personally believe it should turn on whether or not you used deception as the means to gain access. That is, but for your deception, would you have gained access?
This, in my mind, proves they were up to no good (mens rea) and acts to make it clearer whether or not you were authorized. It also connects to the idea that the law is mean to counteract a type of fraud in general. I mean, how can anyone say they had authorized access if they had to lie to gain access?
However, they also explicitly write that they're not addressing that distinction (footnote 8 on page 13, to my best ability to parse it). There's some semantic gap between "policy violations" and "improper motives".
"For present purposes, we need not address whether this inquiry turns only on technological (or “code-based”) limitations on access, or instead also looks to limits contained in contracts or policies. Cf. Brief for Orin Kerr as Amicus Curiae 7 (urging adoption of code-based approach)."
I discovered this nuance from Orin Kerr's twitter (the same one cited in this footnote); he says he's not confident he understands this footnote.
https://twitter.com/OrinKerr/status/1400461828807741455