Opinion ID: 3159682
Heading Depth: 3
Heading Rank: 1

Heading: e., trespass into computer systems or data.

Text: 34 No. 14‐2710‐cr, 14‐4396‐cr At the end of the day, we find support in the legislative history for both Valle’s and the Government’s construction of the statute. But because our review involves a criminal statute, some support is not enough. Where, as here, ordinary tools of legislative construction fail to establish that the Government’s position is unambiguously correct, we are required by the rule of lenity to adopt the interpretation that favors the defendant. Santos, 553 U.S. at 514; United States v. Granderson, 511 U.S. 39, 54 (1994). We do not think it too much to ask that Congress define criminal conduct with precision and clarity. As Chief Justice Marshall explained: The rule that penal laws are to be construed strictly, is perhaps not much less old than construction itself. It is founded . . . on the plain principle that the power of punishment is vested in the legislative, not in the judicial department. It is the legislature, not the Court, which is to define a crime, and ordain its punishment. United States v. Wiltberger, 18 U.S. (5 Wheat.) 76, 95 (1820). We decline to adopt the prosecution’s construction, which would criminalize the conduct of millions of ordinary computer users and place us in the position of a legislature. The role that the rule of lenity plays where doubt remains as to the reach of a criminal statute was discussed in Nosal, where the Ninth Circuit sitting en banc focused sharply on the same compelling concerns that Valle and amici raise on this appeal: [T]he government’s proposed interpretation of the CFAA allows private parties to manipulate their computer‐use and personnel policies so as to turn these relationships into ones policed by the criminal law. Significant notice problems arise if we allow criminal liability to turn on the vagaries of private policies that are lengthy, opaque, subject to change and seldom read. Consider the typical corporate policy that computers can be used only for 35 No. 14‐2710‐cr, 14‐4396‐cr business purposes. What exactly is a ‘nonbusiness purpose’? If you use the computer to check the weather report for a business trip? For the company softball game? For your vacation to Hawaii? And if minor personal uses are tolerated, how can an employee be on notice of what constitutes a violation sufficient to trigger criminal liability? 676 F.3d at 860. The Fourth Circuit, in Miller, agreed with the Ninth Circuit and echoed the same concerns: The deficiency of a rule that revokes authorization when an employee uses his access for a purpose contrary to the employer’s interests is apparent: Such a rule would mean that any employee who checked the latest Facebook posting or sporting event scores in contravention of his employer’s use policy would be subject to the instantaneous cessation of his agency and, as a result, would be left without any authorization to access his employer’s computer systems . . . . [W]e do not think Congress intended . . . the imposition of criminal penalties for such a frolic. 687 F.3d at 206. We agree with the Ninth and Fourth Circuits that courts that have adopted the broader construction “looked only at the culpable behavior of the defendants before them, and failed to consider the effect on millions of ordinary citizens caused by the statute’s unitary definition of ‘exceeds authorized access.’” Nosal, 676 F.3d at 863; see also Miller, 687 F.3d at 206 (“[W]e believe that th[is] theory has far‐ reaching effects unintended by Congress.”). This is the very concern at the heart of the rule of lenity. For example, in United States v. Kozminski, 487 U.S. 931 (1988), the Supreme Court refused to adopt the Government’s broad interpretation of a statute criminalizing involuntary servitude. The Government argued that the statute should criminalize “compulsion 36 No. 14‐2710‐cr, 14‐4396‐cr [to work] through psychological coercion as well as almost any other type of speech or conduct intentionally employed to persuade a reluctant person to work.” Id. at 949. The Supreme Court rejected this interpretation because it would “criminalize a broad range of day‐to‐day activity,” such as “a parent who coerced an adult son or daughter into working in the family business by threatening withdrawal of affection.” Id. The Court warned that the broader statutory interpretation would “delegate to prosecutors and juries the inherently legislative task of determining what type of . . . activities are so morally reprehensible that they should be punished as crimes” and would “subject individuals to the risk of arbitrary or discriminatory prosecution and conviction.” Id. The Government does not reply substantively to Valle’s concerns about the rule of lenity or about the risk of criminalizing ordinary behavior inherent in its broad construction. It merely states that “those concerns must be raised in the first instance by individuals actually affected by the provision at issue,” and that “[t]hose cases will present fact‐specific questions not relevant here, including whether the applicable authorization was clearly defined and whether the abuse of computer access was intentional.” Gov’t Opp’n Br. 15. We disagree. The Government asks that we affirm Valle’s conviction, which requires us to accept its construction of the statute. But our construction of the statute impacts many more people than Valle. It will not only affect those who improperly access information from a government computer – a result some readers might find palatable – but also those who improperly access “any protected computer” and thereby obtain information. 18 U.S.C. § 1030(a)(2)(C). As the Ninth Circuit aptly put it in Nosal, “[b]ecause ‘protected computer’ is defined as a computer affected by 37 No. 14‐2710‐cr, 14‐4396‐cr or involved in interstate commerce – effectively all computers with Internet access – the government’s interpretation of ‘exceeds authorized access’ makes every violation of a private computer use policy a federal crime.” 676 F.3d at 859 (citing 18 U.S.C. § 1030(e)(2)(B)). Whatever the apparent merits of imposing criminal liability may seem to be in this case, we must construe the statute knowing that our interpretation of “exceeds authorized access” will govern many other situations. See 18 U.S.C. § 1030(e)(6). It is precisely for this reason that the rule of lenity requires that Congress, not the courts or the prosecutors, must decide whether conduct is criminal. We, on the other hand, are obligated to “construe criminal statutes narrowly so that Congress will not unintentionally turn ordinary citizens into criminals.” Nosal, 676 F.3d at 863. While the Government might promise that it would not prosecute an individual for checking Facebook at work, we are not at liberty to take prosecutors at their word in such matters. A court should not uphold a highly problematic interpretation of a statute merely because the Government promises to use it responsibly. See United States v. Stevens, 559 U.S. 460, 480 (2010).