1

SUPREME COURT OF THE UNITED STATES

ORDER GRANTING WRIT OF CERTIORARI  

 

 

DENNIS CRANE,

Petitioner, 

v.  

UNITED STATES OF AMERICA,  

Respondent. 

      

No. 10-1010  

NOTICE IS HEREBY GIVEN THAT the petition for writ of certiorari by petitioner in the above named action is granted; the questions being limited to: Issue One: Unauthorized Access Whether the use of a "scraper" program that generates URLs and automatically downloads email addresses displayed on a publicly accessible website, in violation of the website's terms of use, constitutes "unauthorized access" within the meaning of the Computer Fraud and Abuse Act (CFAA). Issue Two: Warrantless Search of a Wireless Network Whether police officers' use of a "Shadow" device to locate an unsecured wireless network and the officers' subsequent opening of a shared folder within that network constitutes a search within the meaning of the Fourth Amendment. Cert. Granted 10/14/2013  

Decision Below: United States v. Crane, 912 F.3d 1130 (12th Cir. 2013)

2

UNITED STATES COURT OF APPEALS

FOR THE TWELFTH CIRCUIT  

 

DENNIS CRANE,

Appellant, 

v.  

UNITED STATES,

Appellee. 

 

 

Appeal from the United States District Court For the District of Ohiowa

 

Argued: December 15, 2012  

Decided: April 8, 2013  

 

Before RUTT, MILDEW & HADDOCK Circuit Judges.  

RUTT, J.: FACTS AND PROCEDURAL HISTORY

CommCorp’s Network and Tablet Devices

CommCorp is a major telecommunications corporation. CommCorp operates a nation-

wide mobile telephone network. Through partnerships with several technology corporations,

CommCorp markets and sells a variety of cell phones, smartphones, and tablet devices that

operate exclusively on CommCorp’s network. Each device that operates on CommCorp’s

network has an individualized identification code consisting of several letters and numbers. The

identification number is included in the paperwork accompanying each device when sold and is

3

also electronically stored within each device. A user can find his or her device’s identification

number by viewing the device’s settings.

CommCorp also operates a website and encourages its customers to register on this

website so that they may access billing data, software updates, and other services. To register,

users must enter their name, address, email address, and the identification code for their device.

Users then choose a password for their account. After registering with CommCorp, users can

enter their email address and password on CommCorp’s website and access their accounts.

In 2011, CommCorp began marketing a tablet device to its users. Users can use the

device to access the internet via CommCorp’s mobile telephone network or through wireless

networks. To make account access easier for CommCorp customers, when users open

CommCorp’s website using a tablet device, their email address automatically appears on the

webpage so they can access their accounts simply by entering their passwords.

CommCorp achieves this result by directing tablet users to specific web addresses

(known as Uniform Resource Locators, or “URLs”) that correspond to their tablet’s

identification number when users access the website from their tablets. At each of these URLs,

the user’s email address is already entered into the page. To illustrate: CommCorp’s default

login page has the URL, “http://www.commcorp.com/login.” When a preregistered tablet user

accesses CommCorp’s website from his or her tablet, however, the user is automatically directed

to a URL, for example:

“http://www.commcorp.com/login/user/openpage?ICCID=XXXXXXXXXXXXXXXXX

XXX,”

where the string of X’s represents the user’s 20-digit tablet identification number. Under this

URL, a tablet user1 will see CommCorp’s login page with his or her email address already

entered into the page.

CommCorp’s website terms of service prohibit website users from accessing web pages

associated with devices they do not own. The terms of service specifically state that website

users may not use their browsers2 to enter device identification numbers that correspond to

1 A computer user who attempts to access this URL will not be able to access an account login page for a tablet because the “user agent” string of a computer communicates to the website that the person attempting to access the page is a computer user and not a tablet user. A “user agent” string communicates with servers and identifies the operating system that is running a user’s web browser. 2 Web “browsers” are software applications that typically include “address bars” into which users may enter URLs for purposes of accessing the webpages associated with those URLs.

4

devices that the users do not own. The terms of service also prohibit users from copying email

addresses from CommCorp’s login pages. These terms of service can be located by scrolling to

the bottom of any page on CommCorp’s website, including the login page, and clicking on a

“Terms of Service” link, which takes users to another webpage with a secondary list of various

terms of service document links for users, businesses, and CommCorp employees. CommCorp’s

terms of service are detailed, and each list of terms amounts to approximately ten pages of text if

printed.

The Defendant’s Use of a Scraper Program on Company’s Website

Defendant’s roommate, Mortimer Burns, purchased a CommCorp Tablet. Burns went to

CommCorp’s website to register his tablet with his CommCorp account that he had previously

established when he bought a CommCorp Smartphone. After registering his tablet, Burns found

that if he accessed CommCorp’s website using the tablet, his email address would automatically

appear – requiring him to only enter his password in order to access his account.

Burns told Defendant that CommCorp’s website automatically generated his email

address. Defendant thought that this could be a potential security breach for CommCorp and

decided to investigate further. When Defendant used his computer to enter the URL associated

with Burns’ login page, Defendant found that he could not access Burns’ login page. Figuring

that this had something to do with the “user agent” string, Defendant modified his computer’s

user agent so that his web browser would identify his computer as a tablet device when accessing

the Internet.

After modifying this computer in this manner, Defendant discovered that he could access

a login page with Burns’ email address already entered on the page by replicating the URL

associated with Burns’ login page. Defendant noticed that a portion of the URL was identical to

Burns’ tablet identification number and suspected that changing this portion of the URL could

allow him to access other web pages with other users’ email addresses.

Accordingly, Defendant developed a “scraper” program. This program, when activated,

would repeatedly enter randomized CommCorp login URLs. The vast majority of these entries

would not contain valid tablet identification numbers and would therefore fail to link to any valid

webpages. When the entered URL would return a page with a user’s email address, the program

5

would copy the pre-entered email address and paste it into a spreadsheet. Defendant activated

the scraper program and let it run for several days. When Defendant deactivated the program, he

had collected over 150,000 email addresses. Among these email addresses were several

addresses belonging to military personnel, government officials, and business executives.

Defendant and Burns contacted several news websites, telling them about their discovery

and use of the scraper program. When notifying these websites of what he had done, Defendant

remarked that CommCorp users were vulnerable to the “theft” of their personal contact

information. Defendant further explained that he had exploited that vulnerability and “stolen”

that information.

A popular technology blog, TechBlog, ended up reporting how CommCorp stored users’

email addresses and that these addresses could be accessed by simply entering a URL with a

device identification number. TechBlog identified Defendant and Burns as the individuals who

had called attention to the situation and reported that a scraper program had been developed that

had downloaded the email addresses of thousands tablet users. TechBlog also displayed several

redacted addresses of high profile tablet users that Defendant had downloaded. TechBlog did

not report that Defendant had developed the scraper program and downloaded those email

addresses.

The Police Officers’ Accessing of Defendant’s Wireless Network and Shared Folder

TechBlog’s story led to an avalanche of negative publicity for CommCorp, with major

newspapers labelling the scraper program as a major security breach. CommCorp contacted the

Federal Bureau of Investigation (FBI) whose agents set out to determine who had developed the

scraper program and downloaded the emails. Because TechBlog had mentioned Defendant and

Burns, the FBI began to investigate them. Two agents, Boot and Block, drove to Defendant’s

neighborhood and parked their vehicle at the side of the street, approximately 200 yards from

Defendant’s house. Agent Boot had a Shadow, a handheld device that detects the presence of

wireless networks.

The Shadow is manufactured and sold to law enforcement by Dwayne Enterprises, a

company that specializes in manufacturing police and military equipment. The Shadow is a

standard piece of equipment in every police vehicle. It is not available for purchase by members

6

of the general public. The Shadow runs a scan for wireless networks within a 500 yard radius

and displays the names and security status of each network that it detects. Moreover, the

Shadow calculates the estimated distance of each wireless network’s router by comparing the

signal strength of each network signal with the type of signal detected.

Agent Boot activated the Shadow and discovered a wireless network that was named

after Defendant. Upon locating this network, Agent Block activated the laptop computer that the

officers had in their car, which also detected the Defendant network. Agent Block noted that

Defendant’s network was not password-protected, meaning that anybody with a laptop computer

could access the network. Once Agent Block logged into this network, he discovered that he had

access to a folder that was shared over that network. Agent Block accessed this folder and found

evidence that identified the folder as belonging to Defendant. Agent Block also uncovered the

spreadsheet with all of the email addresses that Defendant’s scraper program had downloaded.

Once Agents Boot and Block viewed the spreadsheet, they obtained a warrant to search

Defendant’s home to retrieve files, computers, and other electronic storage devices that were

associated with Defendant’s access of CommCorp’s website. When they received the warrant,

Agents Boot and Block entered Defendant’s home. They arrested Defendant, and seized a

number of computers as well as physical documents.

In an evidentiary hearing, Agent Boot testified that the Shadow’s ability to detect

wireless networks, their names, and security statuses were functions that could be carried out by

a laptop computer or Smartphone. Agent Boot testified that he was not aware of any

Smartphone or laptop that could estimate the range of the router for each wireless network.

Defendant was charged with violating the Computer Fraud and Abuse Act (CFAA). 18

U.S.C. §1030. The government argued that Defendant had accessed CommCorp’s webpages

without authorization when he used the scraper program to enter and access the various URLs

associated with tablets. The government further argued that defendant gained additional

unauthorized access when he copied the email addresses using the scraper program. At trial, the

government introduced the spreadsheet they had recovered from the shared network as well as

several other files they had recovered from Defendant’s computer. The trial court denied

Defendant’s Fourth Amendment motion to suppress the evidence and admitted the spreadsheet

and other files.

7

Defendant was convicted and sentenced to a prison term of ten years. He appeals,

arguing that the trial court’s interpretation of the CFAA was erroneous and that his actions had

not constituted unauthorized access. Moreover, Defendant contends that the FBI agents violated

his Fourth Amendment rights when they accessed his wireless network and shared folder.

DISCUSSION

Defendant Violated the CFAA

Defendant argues that his actions did not constitute “unauthorized access” under the

meaning of the CFAA. Defendant claims that the trial court’s determination that his conduct was

unauthorized is erroneous and that the court’s decision should be reversed.

The CFAA is codified at 18 U.S.C. §1030. Defendant was convicted under 18 U.S.C.

§1030(a)(2)(C). Under this provision, anybody who “intentionally accesses a computer without

authorization or exceeds authorized access and thereby obtains . . . information from any

protected computer” shall be punished in accordance with subdivision (c) of the CFAA. 18

U.S.C. §1030(a). The trial court ruled that CommCorp’s website is a “computer” within the

meaning of the CFAA because it fits the definition of a “data storage facility” that is used in

conjunction with computers. 18 U.S.C. §1030(e)(1). Moreover, CommCorp’s website is a

“protected computer” within the meaning of the CFAA because it is used in interstate commerce.

18 U.S.C. §1030(e)(2)(B). Defendant does not challenge this on appeal.

Defendant challenges the trial court’s conclusion that he accessed CommCorp’s website

“without authorization.” Defendant argues that all the scraper program did was enter URLs that

any member of the public could type into a web browser. Defendant argues further that any

member of the public, upon entering a URL, could copy the email that would appear on the

website. Because the scraper program merely duplicated activities that any member of the public

could undertake, the program did not access the website without authorization. The trial court

disagreed with Defendant’s interpretation of the CFAA and held that Defendant’s access of

CommCorp’s website was unauthorized because Defendant’s access deviated from the intended

use of CommCorp’s website and because Defendant violated the website’s terms of service.

8

We begin our inquiry into whether Defendant’s access was unauthorized by looking to

the text of the CFAA. The CFAA does not explicitly define what how an individual may access

a website “without authorization.” The CFAA does define how defendants may exceed

authorized access under 18 U.S.C. §1030(e)(6):

[T]he term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.

This portion of the CFAA does not define what unauthorized access entails, nor does it

specifically describe the point where authorized access crosses the line and exceeds authorization

in violation of the statute. In the absence of explicit definitions, we must look to the common,

contemporary meaning of the terms in the statute. Authorization is defined as “permission or

power granted by an authority.” LVRC Holdings, LLC. v. Brekka, 581 F.3d 1127, 1133 (9th Cir.

2009) (citing Random House Unabridged Dictionary, 139 (2001)) (internal quotations omitted).

Defendant’s use of the scraper program to access web pages associated with different

CommCorp customers and Defendant’s copying of customer email addresses from these pages

was unauthorized access under the CFAA. Defendant’s scraper program gained unauthorized

access because it deviated from the intended use of CommCorp’s website. United States v.

Phillips, 477 F.3d 215, 218-20 (5th Cir. 2007); see also United States v. Morris, 928 F.2d 504,

506, 510 (2d Cir. 1991) (defendant’s use of an early version of email to send a computer virus

constituted unauthorized access within the meaning of the CFAA because defendant’s use of

email deviated from the intended function of the feature).

CommCorp’s website was designed to make it easier for CommCorp tablet users to

access their CommCorp accounts. The website was designed so that tablet users would

automatically be directed to a web page with their email address entered. The only other way to

access these personalized pages would be to type out the website’s URLs—a tedious bit of

guesswork that would require users to type in URLs and hope that they would happen across a

URL contained an appropriate, 20-digit number that matched a CommCorp tablet. Defendant’s

tactic of using the scraper program was similar to that of the defendant in Phillips, who

developed a program that—by repeatedly entering nine-digit numbers intended to replicate social

security numbers—would gain access to websites. Phillips, supra, 477 F.3d at 218. Like the

9

Phillips defendant’s program, here, Defendant’s program used a similar “brute force” technique

of repeatedly guessing the URLs for CommCorp’s users’ web pages until the program happened

to enter a URL that matched an existing page. See id. (describing how a “brute force” attack on

a web page works). Because Defendant accessed CommCorp’s website in a manner that

CommCorp did not intend, his access was unauthorized.

Furthermore, Defendant’s access was far afield from what CommCorp intended because

Defendant had to actively deceive CommCorp’s website by changing his user agent string to

identify his computer as a tablet. This deception not only deviated from the website’s intended

use, but used deceptive practices to circumvent the website’s barriers to access.

Our approach is consistent with existing precedent. In EF Cultural Travel BV v.

Explorica, Inc., Explorica developed a scraper program that accessed the website of the plaintiff,

EF Cultural Travel (EF), a competing travel agency. 274 F.3d 577, 579 (1st Cir. 2001). The

program entered URLs for EF’s webpages, tailoring the URLs it searched to match codes

provided by former EF employees. Id. These codes also appeared to users in publicly visible

URLs as users accessed EF’s website and Explorica’s scraper program simply duplicated these

URLs and downloaded information from the webpages that were generated. Id. at 579, 582-83.

The First Circuit held that the trial court was not mistaken to find that Explorica’s scraper

program was unauthorized access under the meaning of the CFAA. Id. at 584-85.

Here, like the defendant in Explorica, Defendant’s scraper program accessed URLs and

copied information from CommCorp’s webpages. Like the URLs in Explorica, the URLs

Defendant accessed were also publicly accessible. Defendant developed a scraper program to

access CommCorp’s website in a manner similar to the program used by the Explorica

defendant, using the program’s ability to quickly enter URLs so that Defendant could eventually

find those pages that corresponded to tablet users. Accordingly, Defendant’s access to

CommCorp’s website was unauthorized.

The Dissent contends that CommCorp implicitly authorized access to people like

Defendant because any computer user could enter URLs, view, and copy the email addresses on

CommCorp’s website. This framing of the issue underemphasizes the lengths through which

Defendant needed to go to enter the proper URLs. Defendant relied upon a program that

repeatedly entered URLs—many of which were invalid—until, through the brute force of

repeated attempts, he happened to come up with one including a series of numbers and letters

10

that matched a CommCorp tablet. This is analogous to repeated attempts to enter a password on

a restricted webpage—also something that any member of the public can do, and that even critics

of our approach would agree is unauthorized. See Orin S. Kerr, Cybercrime’s Scope:

Interpreting “Access” and “Authorization” in Computer Misuse Statutes, 78 N.Y.U. L. REV.

1596, 1644-45 (2003) (describing a code-based definition of “authorized access” where users

access computers without authorization by circumventing passwords); see also Morris, supra,

928 F.2d at 510 (holding that the “password guessing” feature of a computer worm constitutes

access without authorization).

Even if we chose not to find that Defendant gained unauthorized access by deviating

from the intended use of CommCorp’s website, the website’s terms of service provide us with an

independent avenue of affirming the trial court’s judgment. Because the Defendant’s scraper

program violated the terms of service for CommCorp’s website, Defendant’s use of the program

was unauthorized access under the CFAA. See America Online, Inc. v. LCGM, Inc., 46 F. Supp.

2d 444, 450 (E.D. Va. 1998); see also United States v. Rodriguez, 628 F.3d 1258, 1260, 1263

(10th Cir. 2010) (Social Security Administration employee gained unauthorized access to

database by violating Administration policy against accessing the database for non-business

reasons); America Online v. National Health Care Discount, Inc., 174 F. Supp. 2d 890, 899

(N.D. Iowa, 2001) (defendant’s access was unauthorized because defendant violated terms of

service). This pattern is also consistent with decisions in the context of employee access to

employer computers. See e.g., United States v. John, 597 F.3d 263, 272 (5th Cir. 2010) (Social

Security Administration employee’s access of office records for personal reasons was

unauthorized under the CFAA because it was contrary to Administration policy).

In its terms of service, CommCorp clearly prohibited Defendant’s activity. The CFAA

does not define “authorization,” and in the absence of a statutory definition, we look to the

factual circumstances of this case to determine if CommCorp limited the ability of any of its

users to access its website. CommCorp’s terms of service fill the gap that the CFAA leads open.

The terms of service systematically describe what users on the website cannot do and clearly

restrict CommCorp users from viewing and copying information from pages that are not

associated with their own tablets. While users need to take some active measures to view the

terms of service, every page on CommCorp’s website includes a clear link to these terms,

11

rendering implausible the claim that users cannot be reasonably expected to know the terms of

service.

In the absence of a statutory definition of unauthorized access, website terms of service

may be the next best place to look for meaning. Each site provides its own terms of service and

these terms are tailored to meet the needs of any individual or company with an online presence.

The terms of service are generally accessible to every user of each webpage who clicks on the

link to the terms. Terms of service provide a means to clearly define whether users’ access is

unauthorized under the meaning of the CFAA.

We believe that our interpretation of the CFAA effectively protects website owners and

users. As the facts of this case reveal, an increasing quantity of personal information is stored in

online repositories and technology-savvy individuals are always developing novel, intricate

methods to access this information. Defining “authorization” by referencing the expectations of

those who run websites is the most effective way to ensure that malicious hackers are held

responsible even if their methods are new and creative.

The FBI Did Not Violate the Fourth Amendment by Accessing Defendant’s Wireless Network

and Shared Folder

Defendant argues that Agents Boot and Block’s actions of accessing his wireless network

and shared folder constituted searches within the meaning of the Fourth Amendment. Because

the agents undertook these actions without a warrant, Defendant contends that his Fourth

Amendment rights were violated and that the evidence obtained from the shared folder should

have been excluded.3

The Fourth Amendment prohibits “unreasonable searches and seizures.” U.S. CONST.

amend. IV. To determine whether the conduct of the police constituted a search under the Fourth

Amendment, we look to Katz v. United States, 389 U.S. 347 (1967). In Katz, the Supreme Court

3 At trial, the Government did not argue that the content of Defendant’s shared folder would have inevitably been discovered or could have been located as a result of an independent, lawful search that would have taken place without use of the information discovered in the shared folder. The Government has therefore waived the ability to argue on appeal that even if the search was unlawful, the evidence should not be excluded. Moreover, the government did not contend that there was any imminent risk of document destruction, thereby waiving the government’s ability to argue that any probable cause justified a search in light of exigent circumstances. Contra Warden v. Hayden, 387 U.S. 294, 298-99 (1967).

12

noted that the Fourth Amendment “protects people, not places,” rejecting the traditional

approach of analyzing whether the government’s search infringes on a constitutionally protected

area. Katz v. United States, 389 U.S. 347, 350-51 (1967). This approach requires us to

determine whether the government violated the defendant’s subjective expectation of privacy

and whether society was prepared to recognize this expectation of privacy as reasonable. Id. at

361 (Harlan, J., concurring); see also Kyllo v. United States, 533 U.S. 27, 33 (2001).

We need not delve into whether Defendant subjectively expected his files to be private

when stored in the shared folder. Under the Katz approach, the government must violate both a

subjective and objective expectation of privacy in order for a search to have occurred. Katz,

supra, 389 U.S. at 350-51. We find that Defendant did not have an objectively reasonable

expectation of privacy in his wireless network, nor in the folder he shared over his wireless

network.

This question presents an issue of first impression for this court: whether individuals who

store information on a shared wireless network have a reasonable expectation of privacy in that

information. While the particular technology involved in this case is new territory for this court,

we find that existing Fourth Amendment case law is rife with analogous situations.

The United States Supreme Court has repeatedly held that observations by the police that

may be readily made by members of the public do not constitute Fourth Amendment searches.

There is no Fourth Amendment search when police officers approach a home, knock on the door,

and speak to the occupant. Kentucky v. King, 131 S. Ct. 1849, 1862 (2011). There is no Fourth

Amendment search when police officers use a helicopter to observe a fenced-in yard. California

v. Ciraolo, 476 U.S. 207, 213-14 (1986). The Court reached these holdings using a similar

justification: members of the public would have been able to make observations similar to those

made by the police. Under Katz, “[w]hat a person knowingly exposes to the public, even in his

own home or office, is not a subject of Fourth Amendment protection.” Katz, supra, 389 U.S., at

351.

Here, even if Defendant expected that folders shared over his wireless network would

remain private, this expectation of privacy was not reasonable. The wireless network emanated

from Defendant’s home. This was not a situation where the police needed to use specialized

techniques or equipment. See Florida v. Jardines, 133 S. Ct. 1409, 1416-18 (police use of drug-

sniffing dog at front door of home was a search under the Fourth Amendment); Kyllo v. United

13

States, 533 U.S. 27, 40 (police use of thermal imaging device that is “not in general public use”

was a search under the Fourth Amendment). Anybody with a laptop or Smartphone could have

determined that the network existed and accessed the shared folder over that network, meaning

that Defendant could not have held a reasonable expectation of privacy in the network or in his

folder on that network. See United States v. Borowy, 595 F.3d 1045, 1048 (9th Cir. 2010);

United States v. Sayer, 2012 WL 2180577 No. 2:11–cr–113–DBH at *2 (D. Me. 2012).

The Dissent concludes that Agent Boot’s Shadow device is not available for use by the

public because it had the unique capacity to estimate the distance of Defendant’s wireless router.

This conclusion does not affect our resolution of this case, however, because Agents Boot and

Block did not rely on this function to locate and access the incriminating evidence. While the

Shadow device itself may be unavailable to the public, the functions it carried out that were

relevant to the prosecution were actions that any member of the public in the vicinity of

Defendant’s home could have taken with a publicly available laptop or Smartphone.

Moreover, when Defendant placed documents in a folder that he effectively broadcasted

to the public using his wireless network, he assumed the risk that a third party would come

across this information and notify the authorities. The government’s monitoring of this

broadcasted information is therefore not a search because it falls under the third party doctrine.

See Smith v. Maryland, 442 U.S. 735, 743-44 (1979) (“[t]his Court consistently has held that a

person has no legitimate expectation of privacy in information he voluntarily turns over to third

parties”).

We are certainly not the first court to apply the third party doctrine in the internet context.

See, e.g., United States v. Forrester, 512 F.3d 500, 509-10 (9th Cir. 2008) (holding that to/from

addresses on email are analogous to phone numbers traced by pen register and therefore fall

under the third party doctrine). Moreover, we are not the first to find that a defendant’s

submission of information over a wireless network assumes the risk that the police will gain

access to that information. See United States v. Stanley, 2012 WL 5512987 No. 11–272 at *12

(W.D. Penn. 2012). Even if Agents Boot and Block’s actions intruded into Defendant’s home, as

the Dissent worries, Defendant’s voluntary relinquishment of his documents to members of the

public distinguishes this case from the cases the Dissent cites. See Stanley, supra, 2012 WL

5512987 at *16.

14

Defendant voluntarily relinquished the content of his folder to the public and thereby

assumed the risk that a member of the public would refer that content to law enforcement

authorities. Accordingly, the wireless network and its content falls within the third party

doctrine and Defendant could not have had a reasonable expectation of privacy in his wireless

network and the folders shared over this network.

CONCLUSION

For the foregoing reasons, we find the trial court did not err in its determination that

Defendant’s access of CommCorp’s website was unauthorized under the CFAA. Moreover, we

find that the trial court did not err in admitting evidence obtained through the use of the Shadow

device. Accordingly, the judgment of the trial court is

AFFIRMED

It is so ordered.

HADDOCK, C.J. dissenting

Because the Majority’s interpretation of the CFAA is mistaken and overbroad, and

because Agents Boot and Block carried out a search under the Fourth Amendment, I respectfully

dissent.

Defendant Did Not Violate the CFAA

The Majority contends that the trial court was correct to conclude that the Defendant’s

use of the scraper program constituted unauthorized access of CommCorp’s website under the

meaning of the CFAA. The Majority reaches this conclusion in two distinct ways. The Majority

first concludes that CommCorp did not intend for users to access and download information from

its website with a scraper program, and that this unexpected access constituted unauthorized

access. The Majority separately contends that a violation of website terms of service constitutes

15

unauthorized access. Both of these conclusions rely on a dangerously broad definition of the

CFAA that would criminalize massive amounts of common, online activity. See Pulte Homes,

Inc. v. Laborers’ Int’l. Union of North America, 648 F.3d 295, 299, 304 (6th Cir. 2011)

(defendant’s tactic of sending numerous, repeated emails to website to overload the website’s

computer capacity was not unauthorized under the CFAA because any member of the public

could send emails to the website).

The CFAA does not define when an individual accesses a protected computer “without

authorization.” Accordingly, we must determine the meaning of this terminology by looking to

the contemporary, common meaning of the words in the statute. LVRC Holdings, LLC. v.

Brekka, 581 F.3d 1127, 1132 (9th Cir. 2009). Authorization is defined as “permission or power

granted by an authority.” Id. at 1133 (citing Random House Unabridged Dictionary, 139 (2001))

(internal quotations omitted). When the language of a criminal statute is ambiguous, the rule of

lenity requires courts to construe any ambiguity in favor of the defendant. LVRC Holdings,

supra, 581 F.3d at 1134-35.

The Majority concludes that Defendant’s scraper device went beyond the type of use

CommCorp intended. Even if this were true, the Majority’s conclusion that such unintended use

constitutes unauthorized access under the CFAA is both incorrect and dangerous.

Here, Defendant accessed a series of websites that any member of the public could have

accessed and copied information from these websites—just as any member of the public could

have. Because any member of the public could have accessed CommCorp’s website without

needing to enter a password or overcome any barrier, CommCorp implicitly authorized members

of the public to access the various websites where users’ email addresses were stored. See Pulte

Homes, supra, 648 F.3d at 304. In Pulte Homes, the Sixth Circuit held that individuals have

implied access to websites insofar as they may view content that is not password-protected and

email that website without restriction. Id. Because any member of the public could have viewed

the URLs that Defendant accessed, and because any member of the public could have copied the

email information on these websites, Defendant’s scraper program was not unauthorized access.

While Defendant’s scraper program may have operated on a scale far beyond the capacity

of any individual user, the program’s access to CommCorp’s website was only different in

degree, not kind, from any individual user’s access of that site. CommCorp’s argument that

scraper programs clearly violate the expected use of its website is unconvincing. Furthermore, as

16

a large public corporation with hundreds of thousands of customers, CommCorp should expect

its websites to be accessed thousands of times each day. Here, Defendant visited CommCorp’s

website thousands of times in a single day, a practice that, while unconventional, was no

different from the day-to-day web traffic that CommCorp should have expected.

Further, CommCorp’s subjective hopes and wishes that the public would not visit the

website do not make an unexpected visitor’s access unauthorized. See EF Cultural Travel BV v.

Zefer Corp., 318 F.3d 58, 63 (1st Cir. 2003). In EF, a company used a scraper program to send

queries to a competitor’s website to collect pricing information. Id. at 63. In spite of the fact

that the court recognized that EF would “dislike the use of a scraper,” the court held that the use

of the scraper was not unauthorized access under the CFAA. Id. CommCorp doubtless hoped

that the public at large would not access its users’ login URLs – but premising criminal liability

on an owner’s hopes would severely chill everyday internet users’ willingness to explore the

worldwide web due to fear of potential litigation.

It is no help to the Majority to argue that Defendant’s actions “deceived” the website into

thinking that Defendant was using a tablet. While Defendant’s manipulation of his user agent

string sent an altered operating system signal to websites, the end result of this manipulation was

simply that websites would read Defendant’s computer as a tablet, rather than as a computer.

Anybody in the public can send this message to websites by accessing them using a tablet, and

Defendant’s alteration of his user agent string merely allowed his computer to do so as well.

The Majority finally contends that because Defendant’s use of the scraper program

violated CommCorp’s terms of service, Defendant accessed CommCorp’s website without

authorization. The Majority contends that this case is similar to situations where employees

violate company policies. See, e.g., United States v. John, 597 F.3d 263, 272 (5th Cir. 2010)

(finding unauthorized access when employee violated company policies).

The case before this Court does not involve the clear-cut situations the Majority

references. Here, CommCorp’s terms of service were accessible only to those users who took

the positive actions of scrolling to the bottom of the webpage and clicking on the “Terms of

Service” link. Users then needed to click on the secondary “CommCorp Website Terms of

Service” link. This link leads users to CommCorp’s terms of service for its website, a dense, ten-

page document.

17

CommCorp’s terms of service do not meaningfully protect its website. See Cvent, Inc. v.

Eventbrite, Inc., 739 F. Supp. 2d 927, 933 (E.D. Va. 2010). Unlike a signed confidentiality or

employment agreement, CommCorp’s terms of service are effectively buried out of the sight of

all but the most inquisitive users. While the Majority may be correct to conclude that website

terms of service provide a clear guide to what CommCorp authorizes its users to do, the

Majority’s decision embraces clarity at the expense of practicality. Realistically, no reasonable

user could be expected to notice CommCorp’s terms of service. Id. at 932. Moreover, because

website owners are entirely in control of their website terms of service, using these terms to

define authorized and unauthorized access can lead to absurd results. See Orin S. Kerr,

Cybercrime’s Scope: Interpreting “Access” and “Authorization” in Computer Misuse Statutes,

78 N.Y.U. L. REV. 1596, 1650-51 (2003) (“a computer owner could set up a public web page,

announce that ‘no one is allowed to visit my web page,’ and then refer for prosecution anyone

who clicks on the site out of curiosity”).

Because Defendant’s scraper program merely carried out actions that any member of the

public could have taken, and because Defendant could not have been expected to notice

CommCorp’s terms of service, Defendant’s use of the scraper program did not constitute

unauthorized access under the meaning of the CFAA. Accordingly, Defendant’s conviction

should be reversed.

The FBI Violated Defendant’s Fourth Amendment Rights by Trespassing on Defendant’s Home

and by Infringing Upon His Reasonable Expectation of Privacy

The Majority’s exclusive focus on Katz all but ignores the property-based approach that

the United States Supreme Court developed during its most recent terms. See Florida v.

Jardines, 133 S. Ct. 1409 (2013); United States v. Jones, 132 S. Ct. 945 (2012). In these cases,

the Supreme Court emphasized that intrusion onto an individual’s property can constitute a

search under the Fourth Amendment, whether or not the intrusion violates a reasonable

expectation of privacy.

Contrary to the Majority’s assertion, Katz did not “reject” an approach to Fourth

Amendment analysis based in property law. See Jones, supra, 132 S. Ct. at 950-951. Rather,

“the Katz reasonable-expectation-of-privacy test has been added to, not substituted for, the

18

common-law trespassory test.” Id. at 952 (emphasis in original). If police, while obtaining

information about an individual, act in a manner that intrudes upon the home or that would

constitute common-law trespass, that action is a search under the Fourth Amendment. Jardines,

supra, 133 S. Ct. at 1415-16; Jones, supra, 132 S. Ct. at 949-51.

With this framework in mind, the Fourth Amendment implications of Agents Boot and

Block’s actions are clear. Agent Boot’s initial use of the Shadow device was a search within the

meaning of the Fourth Amendment because this device revealed information about a device

inside of Defendant’s home. This intrusion constitutes trespass to chattels, and is therefore a

search under the Fourth Amendment. See id. (trespass to chattels is a search under the Fourth

Amendment); Register.com, Inc. v. Verio, Inc., 126 F. Supp.2d 238, 249-50 (S.D.N.Y. 2000)

(use of search robot to access an online database was sufficient to show likelihood of success in

trespass to chattels claim); see also Ned Snow, Accessing the Internet Through the Neighbor’s

Wireless Internet Connection: Physical Trespass in Virtual Reality, 84 NEB. L. REV. 1226 (2006)

(arguing that access of wireless router constitutes trespass to chattels). Moreover, even if the

Majority is convinced that the specifics of common law trespass could not have foreseen the

development of wireless networks and the Shadow, the use of this device and the information it

reveals about the interior of the home is intrusion that rises to the level of a Fourth Amendment

search. See Jardines, supra, 133 S. Ct. at 1415-16.

Agent Block’s further action of opening the shared folder revealed even more

information than the initial search by the Shadow. Agent Block not only accessed the wireless

network, but also manipulated information within this network, which further intruded into

Defendant’s home and constituted an additional search. See id.; see also United States v. Ahrndt,

2013 WL 179326 No. 3:08–CR–00468–KI at *6-8 (D. Or. 2013) (police officer’s directing

private citizen to open a file shared over an unsecured wireless network constituted a search

under the Fourth Amendment).

The agents’ actions constituted searches within the meaning of the Fourth Amendment.

Because these searches occurred without a warrant, they were unreasonable and the evidence that

Agents Boot and Block retrieved from Defendant’s wireless network should have been excluded.

This holding is warranted even if one concedes that Majority’s singular focus on Katz is

the proper approach to this case. Agents Boot and Block’s actions used sensitive equipment that

revealed information that Defendant had not sought to share with the public, and this infringed

19

on his reasonable expectation of privacy. See Jardines, supra, 133 S. Ct. at 1418-19 (Kagan, J.

concurring). In addressing infrared scanning technology in Kyllo v. United States, the Supreme

Court held that:

Where, as here, the Government uses a device that is not in general public use, to explore details of the home that would previously have been unknowable without physical intrusion, the surveillance is a ‘search’ and is presumptively unreasonable without a warrant.

533 U.S. 27, 40 (2001).

Here, Agent Boot employed technology that was not in common use. The Shadow is not

sold to members of the general public. Moreover, Agent Boot testified that the Shadow reveals

not only the name and security status of wireless networks, but also calculates the distance of

routers – a function that publicly available devices do not perform. Accordingly, the Shadow fits

directly into the category of devices that the Supreme Court described in Kyllo, and Agent Boot’s

use of the Shadow constituted a search. See id.

In light of Jardines, Jones, and Kyllo, the Majority’s final hope to salvage its ruling is its

attempt to label Defendant’s shared folder as falling within the third party doctrine. Its attempt

to do so stretches the doctrine beyond recognition. Unlike the defendants in Smith, Forrester,

and Stanley, here, Defendant did not submit any information to a third party. Defendant’s

wireless router was in his home and Defendant was not using another party’s router, nor was he

transferring any information to a website or phone service.

The majority repeatedly employs the word “share,” in an apparent attempt to analogize

this case with third party doctrine case law. Here there was no “sharing” in the common sense of

the word – defendant simply had a network that was not password protected, and had a folder

that could be accessed using this network. There is no evidence of intent to transfer this

information to any other party. Accordingly, this case does not fall within the third party

doctrine, and Defendant’s expectation of privacy in his wireless network and folders on this

network was reasonable.

For these reasons, Agents Boot and Block’s actions were unreasonable searches under the

Fourth Amendment and the spreadsheet and other files that these searches revealed should have

been excluded by the trial court. Accordingly, Defendant’s conviction should be reversed.

20

Table of Authorities (Issue 1) Statutes 18 U.S.C. §1030 Cases EF Cultural Travel v. Explorica, Inc., 274 F.3d 577 (1st Cir. 2001) United States v. Phillips, 477 F.3d 215 (5th Cir. 2007) United States v. Morris, 928 F.2d 504 (2d Cir. 1991) Cvent v. Eventbrite, 739 F.Supp. 2d 927 (E.D. Va. 2010) America Online v. National Health Care Discount, 174 F. Supp. 2d 890 (N.D. Iowa 2001) Davies v. Afilias Ltd., 293 F. Supp. 2d 1265 (M.D. Fla. 2003) America Online v. LCGM, 46 F. Supp.2d 444 (E.D. Va. 1998) United States v. Nosal, 676 F.3d 854 (9th Cir. 2012) (en banc) LVRC Holdings v. Brekka, 581 F.2d 1127 (9th Cir. 2009) Pulte Homes v. Laborers' International Union of North America, 648 F.3d 295 (6th Cir. 2011) Clarity Services v. Barney, 698 F. Supp. 2d 1309 (M.D. Fla. 2010) International Airport Centers v. Citrin, 440 F.3d 418 (7th Cir. 2006) United States v. Mitra, 405 F.3d 492 (7th Cir. 2005) EF Cultural Travel BV v. Zefer Corp., 318 F.3d 58 (1st Cir. 2003) Other Sources Orin Kerr, Cybercrime's Scope: Interpreting "Access" and "Authorization" in Computer Misuse Statutes, 78 N.Y.U. L. REV. 1596 (2003) Password, MERRIAM WEBSTER, http://www.merriam-webster.com/dictionary/password.

21

Table of Authorities (Issue 2)

Constitutions

U.S. CONST. amend. IV

Cases

United States v. Jones, 132 S. Ct. 945 (2012) Florida v. Jardines, 133 S. Ct. 1409 (2013) Katz v. United States, 389 U.S. 347 (1967) Kyllo v. United States, 533 U.S. 27 (2001) Kentucky v. King, 131 S. Ct. 1849 (2011) California v. Ciraolo, 476 U.S. 207 (1986) United States v. Knotts, 460 U.S. 276 (1983) United States v. Karo, 468 U.S. 705 (1984) Smith v. Maryland, 442 U.S. 735 (1979) United States v. Borowy, 595 F.3d 1045 (9th Cir. 2010) United States v. Forrester, 512 F.3d 500 (9th Cir. 2008) United States v. Broadhurst, 2012 WL 5985615 No. 3:11–cr–00121–MO–1 (D. Or. 2012) United States v. Stanley, 2012 WL 5512987 No. 11–272 (W.D. Penn. 2012) United States v. Ahrndt, 2013 WL 179326 No. 3:08–CR–00468–KI. (D. Or. 2013) United States v. Sayer, 2012 WL 2180577 No. 2:11–cr–113–DBH. (D. Me. 2012) Intel Corp. v. Hamidi, 71 P.3d 296 (Cal. 1996) America Online, Inc. v. National Health Care Discount, Inc., 121 F. Supp.2d 1255 (N.D. Iowa 2000). Register.com, Inc. v. Verio, Inc., 126 F. Supp.2d 238 (S.D.N.Y. 2000). eBay, Inc. v. Bidder’s Edge, Inc., 100 F. Supp. 2d 1058 (N.D. Cal. 2000)

Articles

Orin S. Kerr, The Fourth Amendment and New Technologies: Constitutional Myths and the Case for Caution, 102 MICH. L. REV. 801 (2004)

Ned Snow, Accessing the Internet Through the Neighbor’s Wireless Internet Connection: Physical Trespass in Virtual Reality, 84 NEB. L. REV. 1226 (2006)