In the first part of his analysis, Judge Wu gave the CFAA's language a broad reading, finding that it could encompass the facts of Drew's case. The relevant provision of the CFAA prohibits "intentionally access[ing] a computer without authorization or exceed[ing] authorized access" and thereby obtaining "information" from a computer used in interstate commerce. 18 U.S.C. 1030(a)(2)(C). The court found that "accessing" a computer simply means transmitting and receiving electronic signals from it, not working around code-based controls or gaining entry into non-public files or areas. Judge Wu thought a narrower approach might be "preferable," but found no support for this view in the case law or legislative history. Slip Op. at 17-18. The court also held that, putting constitutional concerns aside, an intentional breach of website terms could constitute accessing a computer or server "without authorization" or "in excess of authorization." See id. at 19-22.
The court explained that treating any and all terms violations as revoking access might solve the vagueness problem, but would transform the CFAA into "an overwhelmingly overbroad enactment that would convert a multitude of otherwise innocent Internet users into misdemeanant criminals" and provide no meaningful guidelines for law enforcement. Id. at 26-27, 29. Judge Wu seemed particularly concerned by the prospect of the unbounded statute allowing federal prosecutors "to pursue their personal predilections":
[I]f every such breach does qualify, then there is absolutely no limitation or criteria as to which of the breaches should merit criminal prosecution. All manner of situations will be covered from the more serious (e.g. posting child pornography) to the more trivial (e.g. posting a picture of friends without their permission). All can be prosecuted. Given the "standardless sweep" that results, federal law enforcement entities would be improperly free "to pursue their personal predilections."
Id. at 31-32 (citations omitted).
For background on the case and copies of many of the court documents, see our database entry, United States v. Drew.