Big Win for Ethical Hacking - Threatwire
Added 2021-06-08 21:00:03 +0000 UTCShannon Morse, Threatwire
Ethical hacking just got a win after being very concerned about the outcome of an important case for a long time now. A former Georgia police sergeant named Nathan Van Buren accessed a police database to get information on a license plate. In exchange for this information, he was paid $6000 in cash. Van Buren used the computer in his police vehicle to access Georgia’s Crime Information Center. Van Buren was a cop, so he used his own creds to access this information but it had nothing to do with any ongoing investigations or duties that he had to perform as a cop, so he was using his power for personal gain. The person who wanted the information from him had previous ties to criminal activity and paid him the cash.
So the US District Court for the Northern District of Georgia convicted him for violating policy by obtaining info for personal use, and violating CFAA by using a PC on that network for something other than his duties as a police officer. He got 18 months.
This was appealed and eventually made it to the Supreme Court. The Supreme Court ruled that his actions did NOT violate CFAA, which is the Computer Fraud and Abuse Act of 1986, in a 6-3 decision. The Supreme Court decided that because he used his own credentials, that wouldn’t be within the scope of violating CFAA. The dissenters were Chief Justice Clarence Thomas, Justice Samuel Alito and Justice John Roberts.
The reason why this was lauded as a win by the EFF and ethical hackers is because the CFAA is incredibly broad and could be misinterpreted. This ruling affirms that services can’t invoke it because you use their service to collect evidence on security vulnerabilities, for example. So this ruling could be used for future cases as precedent when security researchers are taken to court over ethical hacking.
CFAA:
https://www.zdnet.com/article/supreme-court-ruling-limits-use-of-hacking-law/
https://threatpost.com/court-limits-scope-hacking-law/166672/
https://www.bleepingcomputer.com/news/security/us-supreme-court-restricts-broad-scope-of-cfaa-law/
Support ThreatWire! https://www.patreon.com/threatwire
