A Vague Law in a Smartphone World: Limiting the Scope of Unauthorized Access under the Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act (CFAA) broadly criminalizes unauthorized access to computers and digital information, but how far should these federal prohibitions reach into the mobile data space? As smartphones and mobile applications continually redefine the digital landscape, attempts to apply the decades-old anti-hacking statute in this new territory have created potentially disturbing precedent.Courts and critics have struggled to interpret the arguably vague and ambiguous provisions of the CFAA and have turned to contract law, agency law, and computer science for guidance. This Comment contends that the contract- and agency-based interpretations implicate constitutional vagueness concerns, and the code-based approach does not sufficiently address "insider" misuse of information. In the context of mobile application data privacy, the shortcomings of current interpretations necessitate a narrower view of unauthorized access. By limiting liability to only traditional notions of hacking and serious misuse of information, the CFAA can better serve its original and primary purpose: punishing criminal computer hackers and those who abuse legitimate access rights."I think there is a world market for maybe five computers."-Thomas Watson, Chairman of IBM, 1943INTRODUCTIONCell phones are ubiquitous.1 As handheld devices become increasingly affordable and network service providers continue to expand cellular and data bandwidth, advanced mobile devices, or smartphones, have become similarly widespread.2 According to one recent study by the Pew Research Center, eighty-eight percent of Americans own some kind of cell phone, while forty-six percent of Americans own a smartphone.3 One of the most common and distinctive features of today's smartphones is mobile applications, or "apps." Apple's often-quoted and parodied advertising slogan, "there's an app for that," seemingly encapsulates the current panoply of apps across numerous genres available to smartphone users.4 With the meteoric rise of smartphones and app usage over the last few years,5 concerns over data privacy in the mobile space have garnered similar attention from legislators,6 regulators,7 and the general public.8Despite increasing legislative and media attention on mobile data privacy, many app developers have not adopted self-regulatory measures to protect user privacy.9 A recent Wall Street Journal investigation of the 101 most popular mobile apps on the market revealed that forty-five did not include privacy policies of any kind.10 Moreover, fifty-six apps transmitted the unique device identification (UDID), a serial-like number that can be linked to other user data,11 to third-party companies without the users' awareness or consent.12 Amidst these growing concerns over protecting users' information, both law enforcement and private citizens have looked for new ways to bring their concerns before the judiciary.13 Some of these novel approaches, however, may push the envelope too far.App users alleging privacy infringement have recently sought redress under the Computer Fraud and Abuse Act14 (CFAA), a federal criminal statute originally designed to combat "juvenile computer hacker" attacks against the federal government's computers.15 Despite the statute's narrow origin, the CFAA now broadly criminalizes and permits private civil actions against anyone who "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . (C) information from any protected computer."16 Typical criminal and civil cases under the CFAA involve traditional notions of hacking government computers,17 stealing trade secrets to establish competing businesses,18 or large- scale data theftvia malicious code or "botnets."19 Law enforcement20 and classes of app users,21 however, now argue that app developers and mobile advertisers can be liable under the CFAA when an app merely obtains information from the user's smartphone for targeted advertisements and marketing analytics. …