Supreme court ruling is a win for whistleblowers
What if Bill, an employee of XYZ Inc., had access to company data proving his employer was defrauding the government and he decided to be a whistleblower, reporting his employer to federal authorities?
In the past, some courts may have ruled that Bill was guilty of a felony
SCOTUS to the rescue
In June, the Supreme Court of the United States (SCOTUS) ruled in Van Buren v. United States, interpreting the Computer Fraud and Abuse Act of 1986 (CFAA), which makes it illegal to “exceed authorized access” of a computer. While not technically a whistleblower case, the ruling can be considered a win for whistleblowers.
In recent years, broad interpretations of the CFAA led to negative consequences for some whistleblowers. Specifically, some companies had used the CFAA to attack employee whistleblowers who took computer data from their employers and provided it to the government as evidence in fraud cases. For example, XYZ Inc. may have authorized Bill to access to files for purposes of his job, but XYZ Inc. could say turning over data to the government was unauthorized, and therefore in violation of the CFAA.
In such a situation, the only “unauthorized access” in question would be the whistleblower employee turning over computer data to the government as evidence of fraud against the United States. This act of attempting to recover taxpayer dollars from fraudsters opened the whistleblowers to costly CFAA actions. However, with the decision by the Court in Van Buren, such retaliatory tactics will no longer hold up.
Far reaching effects
The ruling was needed because circuit courts in recent years have been split on how they interpreted the CFAA which was originally enacted as an anti-hacking statute.
Ultimately the Supreme Court adopted a narrow view and held that “an individual ‘exceeds authorized access’ when he accesses a computer with authorization but then obtains information located in particular areas of the computer—such as files, folders, or databases—that are off-limits to him.” The court added, however, that the CFAA does not cover impermissible uses of properly accessible files.
While the Van Buren case dealt with criminal charges under the CFAA, the decision has far-reaching effects. As stated by the Court, a broad reading of the CFAA “would attach criminal penalties to a breathtaking amount of commonplace computer activity,” and would “criminalize every violation of a computer-use policy.” Thus, before this narrower interpretation, companies could have instituted “computer-use policies” that would have prevented employees from turning over files they were authorized to access to law enforcement in an effort to report criminal activity.





















































