SlideShare uma empresa Scribd logo
1 de 24
Baixar para ler offline
16
(N.Y. 2009)). With such technology at the government’s disposal, “[t]he whole of a person’s
progress through the world, into both public and private spatial spheres, can be charted and
recorded over lengthy periods . . . .” Weaver, 909 N.E.2d at 1195. Now, prolonged tracking is
“not merely possible[,] but entirely practicable . . . .” Id. The emergence of such technology “will
continue to shape the average person’s expectations about the privacy of his or her daily
movements.” Jones, 132 S.Ct. at 963 (Alito, J., concurring).
The Supreme Court’s previous technology-based decisions do not apply because the
extended surveillance of Leomund by federal officers lasted far beyond a single destination and
beyond a single day. In total, officers monitored Leomund for sixteen (16) days and twenty
minutes (20) without a warrant. J.A. 15-16. The sixteen (16) day surveillance revealed a number
of private details of Leomund’s life, from visiting a urologist and psychiatrist’s office, to
attending a gentlemen’s club. Id. at 15. It was not until day sixteen that federal officers had
specific evidence that Leomund had anything to do with the leak of the Phyresis pathogen. Id. at
16. Prior to that time, Leomund’s private affairs became known to the federal officers, all of
which were irrelevant to the access of CDC-Secure. Id. at 15. Allowing that amount of extended
surveillance, only to have something relevant on day 16, is a clear violation of Leomund’s
expectation of privacy that society would consider reasonable. Therefore, an unreasonable search
has occurred, in violation of the Fourth Amendment.
ARGUMENT
I. LEOMUND DID NOT VIOLATE THE COMPUTER FRAUD AND ABUSE ACT
BECAUSE THE TERM “WITHOUT AUTHORIZATION” ONLY
CONTEMPLATES UNAUTHORIZED ACCESS, NOT UNAUTHORIZED USE
The Computer Fraud and Abuse Act (“CFAA”) is a federal statute enacted primarily to
combat computer hacking. WEC Carolina Energy Solutions, LLC. v. Miller, 687 F.3d 199, 201
17
(4th Cir.2012) (citing A.V. ex rel. Vanderhye v. iParadigms, LLC., 562 F.3d 630, 645 (4th
Cir.2009)). The CFAA prohibits a number of crimes relating to computer use, including the
prohibition of any individual who “intentionally accesses a computer without authorization . . . .”
18 U.S.C.A. §1030(a)(2). A violation of the CFAA exposes an individual to both criminal and
civil liability. Miller, 687 F.3d at 201. However, “authorization” is not defined by the CFAA. In
interpreting the meaning and scope of “authorization”, the Fourth and Ninth Circuits apply the
narrow interpretation, which requires the plain meaning of the term to be examined. Miller, 687
F.3d at 203; LVRC Holdings v. Brekka, 581 F.3d 1127, 1130, 1132 (9th Cir.2009). In other
words, the “‘ordinary, contemporary, [or] common meaning’” of the term will be used. Id. at
1133 (quoting Perrin v. United States, 444 U.S. 37, 42 (1979)). On the other hand, the First,
Fifth, Seventh, and Eleventh Circuits apply the broader interpretation. EF Cultural Travel Bv v.
Explorica, 274 F.3d 577 (1st Cir. 2001); United States v. John, 597 F.3d 263 (5th Cir. 2010);
Int’l Airport Ctrs., LLC v. Citrin, 440 F.3d 418 (7th Cir. 2006); United States v. Rodriguez, 628
F.3d 1258 (11th Cir. 2010). Since the plain language of the CFAA indicates that the only
conduct that is clearly covered by the statute is the accessing of a computer “without
authorization,” not “unauthorized use,” and Congress did not explicitly prohibit “unauthorized
use,” Leomund has not violated the “without authorization” provision of the CFAA.
A. The Plain Meaning Of “Without Authorization” Prohibits An Employee From
Unlawfully Accessing An Employer’s Computer, Not Unlawfully Using It.
In Miller, Miller was charged with violating the Computer Fraud and Abuse Act
(“CFAA”). Miller, 687 F.3d at 201. Miller worked as Project Director for WEC Carolina Energy
Solutions, Inc. Id. at 202. As an employee of WEC, Miller was given a laptop computer and cell
phone. Id. Miller was authorized to access WEC ‘s intranet and computer servers. Id. WEC
established policies prohibiting employees from using its information without authorization or
18
downloading the information on a personal computer. Id. However, the policy did not restrict
Miller’s authorization to access WEC’s information. Id. Miller resigned from WEC and began
working with Arc Energy Services, Inc., WEC’s competitor. Id. at 201. Prior to his resignation,
Miller is alleged to have downloaded a number of WEC’s confidential information and emailed
them to a personal email address as well as saved them onto a personal computer. Id. at 202.
Additionally, Miller is alleged to have used WEC’s information to obtain a potential WEC
customer for the benefit of Arc. Id. The customer retained Arc’s services. Id. As a result, WEC
alleges that Miller lost all authorization to access WEC’s confidential information when he
downloaded WEC information onto his personal computer. Id.
The court held Miller did not violate the CFAA. Id. at 207. The CFAA is primarily a
criminal statute that was established to combat computer hacking. Id. at 201 (citing iParadigms,
LLC., 562 F.3d at 645). However, the CFAA does not define “authorization.” Miller, 687 F.3d at
204. When interpreting the meaning of a term of a statute, “the plain [meaning] of the [term is to
be analyzed], seeking ‘first and foremost . . . to implement congressional intent.’” Id. at 203
(quoting United States v. Abdelshafi, 592 F.3d 602, 607 (4th Cir. 2010)). The plain meaning of a
term is its “‘ordinary, contemporary, common meaning,’ unless Congress has indicated the term
bears a different meaning. Miller, 687 F.3d at 203-04 (quoting Stephens ex rel. R.E. v. Astrue,
565 F.3d 131, 137 (4th Cir. 2009)). If the statute has both civil and criminal application, the
interpretation of the term is to be applied “uniformly in both contexts.” Miller, 687 F.3d at 204
(citing Leocal v. Ashcroft, 543 U.S. 1, 11 n.8 (2004)). Since the CFAA is a criminal statute, the
terms must be strictly construed in accordance with the rule of lenity, avoiding any
interpretations “not ‘clearly warranted by the text[.]’” Miller, 687 F.3d at 204 (quoting Crandon
v. United States, 494 U.S. 152, 160 (1990)). The plain meaning of “‘authorization’” is “‘formal
19
warrant, or sanction.’” Miller, 687 F.3d at 204 (quoting Oxford English Dictionary (2d ed. 1989;
online version 2012)). The CFAA only covers “unauthorized access of protected computers.” Id.
(emphasis added). The plain meaning of “‘access’” is “‘to gain admission to [something].’”
Miller, 687 F.3d at 204 (quoting Oxford English Dictionary (3d ed. 2011; online version 2012)).
Therefore, based on the plain meanings of “authorization” and “access,” an employee accesses a
computer “without authorization” under the CFAA when “he gains admission to a computer
without approval.” Miller, 687 F.3d at 204 (citing Brekka, 581 F.3d at 1133). It does not extend
to the “improper use of information validly accessed.” Miller, 687 F.3d at 204 (emphasis added).
Since Miller had authorized access to WEC’s intranet and computer servers as well as all of
WEC’s information stored on the servers, he did not violate the “without authorization”
provision of the CFAA. Id. at 207.
In Brekka, Brekka was charged with violating the Computer Fraud and Abuse Act
(“CFAA”). Brekka, 581 F.3d at 1129. Brekka was hired by LVRC to oversee aspects of it’s
residential treatment center for addicted persons. Id. Brekka was to maintaining contact with
LOAD, Inc., a company that provided email, website, and related services for the facility. Id.
Brekka also was responsible for conducting internet marketing programs. Id. While working for
LVRC, Brekka owned and operated two consulting businesses that provided addiction
rehabilitation services and referrals to rehabilitation facilities through the use of internet sites and
advertisements. Id. The owner of LVRC was aware of Brekka’s business. Id. As an employee of
LVRC, Brekka was assigned a computer. Id. However, while commuting to and from his other
businesses, Brekka emailed LVRC documents to his personal computer. Id. at 1129-30. There
was no policy prohibiting employees from emailing LVRC documents to personal computers. Id.
Brekka eventually resigned from LVRC, but continued to access LVRC documents based on the
20
log-in credentials assigned to him by LOAD’s administrator. Id. at 1130. LVRC alleges that
Brekka accessed its computers “without authorization” when he emailed the LVRC documents to
his personal computer. Id. at 1128.
The court held Brekka did not violate the CFAA. Id. at 1137. The CFAA was established
to allow the government to prosecute computer crimes, specifically, computer hackers who
sought to steal information or interrupt the functionality of computer systems. Id. Interpreting the
meaning of “without authorization” requires an analysis of the plain language of the CFAA. Id.
at 1132 (citing United States v. Blixt, 548 F.3d 882, 887 (9th Cir. 2008)). When a statute does
not define a word, it is a “‘fundamental canon of statutory construction’” that the “‘ordinary,
contemporary, [or] common meaning’” of the word be used. Brekka, 581 F.3d at 1133 (quoting
Perrin, 444 U.S. at 42). The CFAA is primarily a criminal statute, and when there is ambiguity in
a criminal statute, it should be resolved “‘in favor of lenity.’” Brekka, 581 F.3d at 1134 (quoting
United States v. Carr, 513 F.3d 1164, 1168 (9th Cir.2008)). When the statute has both criminal
and civil implications, it should be interpreted consistently in both contexts. Brekka, 581 F.3d at
1134 (citing Ashcroft, 543 U.S. at 11 n.8 (2004)). The plain meaning of “authorization” applies
when an individual is “‘authorized’” to access the company’s computer. Brekka, 581 F.3d at
1134 (quoting Webster’s Third International Dictionary, 146 (2002)). Therefore, under the
CFAA, “without authorization” occurs when an employee “accesses a computer without any
permission at all . . . .” Brekka, 581 F.3d at 1134. Additionally, an employee accesses a computer
“without authorization” when his prior authorization to access the computer was rescinded by his
employer, but he uses it anyway. Id. at 1135. Since there was no dispute that Brekka was
authorized to access and use LVRC’s computer, he did not violate the “without authorization”
provision of the CFAA. Id. at 1133.
21
Like the defendants in Miller and Brekka, Leomund was granted access to CDC-Secure
while employed at the CDC. J.A. 14. Although there was a restriction as to the disclosure of the
information contained in CDC-Secure, there was no restriction as to his access of CDC-Secure.
Id. at 14, 28-29. Despite his being transferred to another department, nothing in the record even
suggests Gant had told Leomund that he was restricted as to what he could access on CDC-
Secure. Id. at 14. In both of his positions, Leomund was required to access CDC-Secure. Id.
Additionally, when Leomund received information about the Phyresis pathogen from Edgeworth
after Leomund was fired, Leomund did not access CDC-Secure himself, for that would have
constituted access “without authorization.” Instead, Edgeworth, a current employee of the CDC,
serving in same capacity as Leomund had once served, had accessed CDC-Secure. Id. at 16.
Therefore, under the plain meaning of the CFAA, Leomund never accessed CDC-Secure
“without authorization.”
In JBCHoldings NY, LLC v. Pakter, Pakter was charged with violating the Computer
Fraud and Abuse Act (“CFAA”). JBCHoldings NY, LLC v. Pakter, 931 F. Supp. 2d 514, 519
(S.D.N.Y.2013). Pakter began working with JBCHoldings (“JBC”) after Pakter sold her
company to JBC. Id. at 518. Pakter’s responsibility at JBC was to obtain business for JBC. Id.
Pakter signed an agreement that she would not compete with JBC. Id. However, JBC discovered
that Pakter had been diverting business to another company that she had established. Id. at 518-
19. Additionally, JBC discovered that Pakter had been receiving fees from JBC’s clients and
diverting the funds to her other company. Id. at 518. Furthermore, JBC discovered that Pakter
had been in contact with present and former JBC clients. Id. at 519. JBC alleged that Pakter
accessed the client information without authorization when she used it to benefit her own
business. Id. at 519.
22
The court held Pakter did not access the JBC’s information “without authorization”
because such access to client information was part of her job. Id. at 525. In defining “without
authorization,” the plain meaning of the statute is to be analyzed. Id. at 523. If the statute does
not define a term, that term “must be given its ‘ordinary, contemporary, common meaning.’” Id.
(quoting Perrin, 444 U.S. at 42). As a result, “the common meaning of ‘without authorization’ is
‘without any permission at all.’” Pakter, 931 F. Supp. 2d at 523 (quoting United States v.
Aleynikov, 737 F. Supp. 2d 173, 191 (S.D.N.Y.2010)). Therefore, an employee acts “without
authorization” under the CFAA when “he does so without permission to do so.” Pakter, 931 F.
Supp. 2d at 523. The definition speaks only to access, not use. Id.
B. The Broad Interpretation That “Without Authorization” Includes Violations of
Employer Policies Is Contrary To Legislative Intent.
In Int’l Airport Ctrs., LLC v. Citrin, Citrin was charged with violating the Computer and
Fraud Abuse Act (“CFAA”). Int’l Airport Ctrs., LLC. v. Citrin, 440 F.3d 418, 418-19 (7th Cir.
2006). Citrin worked for International Airport Centers (“IAC”), for which he was assigned a
laptop to be used for the recording of data he obtained while working with IAC. Id. at 419. Citrin
resigned from IAC and entered into his own business, which was a violation of his employment
contract with IAC. Id. Before returning his IAC laptop, Citrin deleted all of the data stored on it.
Id. Such data included not only those he had collected while working for IAC, but also data that
would have informed IAC of improper conduct that he had engaged in while working for IAC.
Id. In order to do so, Citrin installed a secure-erase program that prevented the deleted files from
being recovered by IAC. Id. IAC possessed no copies of the deleted data. Id.
The court held Citrin had accessed IAC’s laptop without authorization because he
breached a duty of loyalty to IAC. Id. at 420-21. Citrin’s installing of the secure-erase program
was intended to cause damage to the IAC laptop’s files to the extent that IAC could not recover
23
them. Id. at 419. Citrin’s authority to use the laptop had terminated when he (1) engaged in
misconduct on it, (2) quit IAC in violation of his employment contract, and (3) deleted files that
would have incriminated himself as well as files that rightly belonged to IAC, which was a
violation of his duty of loyalty to IAC. Id.
Allowing “without authorization” to cover violations of employer restrictions “wraps the
intent of the employees and use of the information into the CFAA despite the fact that the statute
narrowly governs access, not use.” Jones, 957 F. Supp. 2d at 619. Requiring the mental intent of
the employees be considered in the analysis would “collapse [the CFAA’s] independent
requirements into a single inquiry . . . .” Brett Senior & Assocs., P.C. v. Fitzgerald, No. 06-1412,
2007 U.S. Dist. LEXIS 50833, at *15 (E.D. Pa. July. 13, 2007). As a result, the CFAA’s primary
objective of punishing conduct that is “tantamount to trespass in a computer” would not longer
be applicable. Clinton Plumbing and Heating of Trenton, Inc. v. Ciaccio, et. al., No. 09-2751,
2010 U.S. Dist. LEXIS 113215, at *18 (E.D. Pa. Oct. 22, 2010).
II. LEOMUND DID NOT VIOLATE THE CFAA BECAUSE APPLYING AGENCY
PRINCIPLES TO DETERMINE WHETHER AN EMPLOYEE “EXCEEDS
AUTHORIZED ACCESS” FALLS OUTSIDE THE ORIGINAL
CONGRESSIONAL INTENT
The Computer Fraud and Abuse Act (“CFAA”) was enacted in order to “address the
growing problem of computer hacking . . . .” United States v. Nosal, 676 F.3d 854, 858 (9th
Cir.2012). The CFAA prohibits a number of crimes relating to computer use, including the
prohibition of any individual who “exceeds authorized access . . . .” 18 U.S.C.A. §1030(a)(2). An
individual “exceeds authorized access [when he gains access to] a computer with authorization to
use such access to obtain or alter information in the computer that the accesser is not entitled so
to obtain or alter.’” Nosal, 676 F.3d at 856. Since the plain language of the CFAA indicates that
the only conduct that is clearly covered by the statute is the employer obtaining information that
24
is outside the bounds of his approved access, Leomund has not violated the “exceeds authorized
access” provision of the CFAA.
A. The Plain Meaning Of “Exceeds Authorized Access” Prohibits An Employee
From Obtaining Information That Falls Outside The Bounds Of His Approved
Access.
In Nosal, Nosal was charged for violating the Computer Fraud and Abuse Act (“CFAA”).
Nosal, 676 F.3d at 856. Nosal worked for Korn/Ferry, an executive search firm. Id. After leaving
the company, Nosal had other Korn/Ferry employees to send him Korn/Ferry information stored
in a confidential database on the firm’s computer. Id. The employees used their log-in credentials
to download Korn/Ferry information. Id. The employees had authorization to access the
confidential database, but Korn/Ferry prohibited employees from disclosing the confidential
information. Id. It is alleged Nosal aided and abetted the employees in violating the CFAA,
specifically, exceeding the employees’ authorized access to Korn/Ferry’s confidential database.
Id.
The court held that the phrase “exceeds authorized access” is limited only to violations
regarding company restrictions on access to information, not to that information’s use. Id. at 864
(emphasis added). The plain language of the CFAA focuses on the unauthorized access of
information and not its subsequent misuse. Id. at 863.
In Dresser-Rand Co. v. Jones, Jones was charged with violating the Computer Fraud and
Abuse Act. Dresser-Rand Co. v. Jones, 957 F. Supp.2d 610, 611 (E.D. Pa. 2013). Jones was a
manager for Dresser-Rand. Id. Eventually, Jones resigned from Dresser-Rand. Id. However,
prior to his resignation, Jones went to work with Global Power Specialist, Inc. Id. Jones
downloaded Dresser-Rand documents to external hard drives and flash drives. Id. Thousands of
Dresser-Rand documents were discovered to have been transferred from the external devices to
25
Global Power’s computers and accessed from Global Power’s computers. Id. at 612. Jones
emailed some Dresser-Rand business information to Global Power through using Dresser-Rand
computers. Id. An official of Dresser-Rand stated that he did not believe Jones accessed
information other than what he had authorized access to do using their Dresser-Rand user name
and password. Id. Dresser-Rand has a policy that prohibits employees from disclosing company-
sensitive or privileged information. Id. Additionally, employees are prohibited from using
Dresser-Rand’s systems in a way that “‘jeopardizes the integrity of the equipment, violates any
Company policy, or is not in the best interest of the Company.’” Id. By using Dresser-Rand’s
system, Jones consented to the policies. Id. at 613. Dresser-Rand is alleged to have exceeded his
authorized excess to Dresser-Rand’s computers by downloading Dresser-Rand files to flash
drives and external hard drives to benefit Global Power. Id. at 614.
The court held Jones had not exceeded his authorized access to Dresser-Rand’s
computers and, therefore, did not violate the CFAA. Id. at 619. Dresser-Rand’s policies only
governed use, not access. Id. at 620. The CFAA governs only unauthorized computer access, not
file access. Id. at 621. Jones accessed the downloaded documents from his Dresser-Rand
computer and stored them on external storage devices, while employed at Dresser-Rand. Id. at
620. He had a user name and password to access the Dresser-Rand network as well as the
laptops and external hard drives. Id. There were no limitations as to Jones’ ability to copy
documents from the information he had authorized access to access. Id. Since he was authorized
to access his work laptop and download files from it, he was not liable under the CFAA, despite
the fact that he misused the information afterwards. Id. The Computer Fraud and Abuse Act
(“CFAA”) prohibits accessing computers in a manner in excess of what he has been authorized
and obtaining information or damaging computer data. Id. at 613 (citing 18 U.S.C. § 1030(a)).
26
Violating the CFAA exposes an individual to both civil and criminal liability. Jones, 957 F.
Supp. 2d at 613. The CFAA’s original purpose was to provide a legal remedy to those victimized
by computer hackers. Id. An individual has exceeded authorized access under the CFAA when
he obtains or alters information to which he is not entitled. Id. at 614. However, the CFAA does
not define “authorization,” which requires courts to “wrestle with the breadth of its meaning . . .
.” Id. at 615.
In Int'l Ass'n of Machinists & Aerospace Workers v. Werner-Matsuda, Werner-Matsuda
was charged with violating the Computer Fraud and Abuse Act (“CFAA”). Int'l Ass'n of
Machinists & Aerospace Workers v. Werner-Matsuda, 390 F. Supp. 2d 479, 484 (D. Md. 2005).
Werner-Matsuda served as International Association of Machinists & Aerospace Workers’
(“IAM”) Secretary-Treasurer of a lodge IAM owned. Id. at 483. As an employee of IAM,
Werner-Matsuda had access to IAM’s secured website which contained IAM’s confidential
membership list. Id. Werner-Matsuda signed an agreement not to use confidential information
located on the secure website that was contrary to IAM’s Constitution. Id. However, Werner-
Matsuda had accessed the confidential information and used it to help another company seeking
to challenge IAM in the union business. Id. IAM alleges Werner-Matsuda “exceeded her
authorization” by violating the agreement she signed before working with IAM. Id. at 495.
The court held that Werner-Matsuda did not exceed her access. Id. at 499. The court
acknowledged that there is a distinction between mere use and authorization to access
information and that the plain language of the statute necessitated their holding, because the
CFAA does not prohibit unauthorized use of information. Id. at 499. The court pointed to
legislative history, the fact that the CFAA is generally seen as a criminal statute and thus should
be construed narrowly, and persuasive case law to come to its ultimate conclusion. Id. at 499.
27
Like the defendants in Nosal, Jones, and Werner-Matsuda, Leomund did not exceed his
authorize access. There is no dispute that when Leomund accessed CDC-Secure himself, he was
authorized to so as part of his job as the Assistant Content Director/Disease Projection Analyst in
the Public Records Division of the CDC. J.A. 13-14. Additionally, even after Gant transferred
Leomund to the department that analyzed the Alzheimer’s disease in American citizens, he still
had authorization to access CDC-Secure. Id. at 14. Furthermore, after Leomund was terminated,
he never gained access to CDC-Secure himself, but obtained the information from Edgeworth, a
Topography Specialist of the CDC. Id. at 16.
B. Applying A Broader Interpretation Of “Exceeds Authorized Access” Using
Agency Principles Has Far-Reaching Effects Not Intended By Congress.
In EF Cultural Travel Bv v. Explorica, Explorica is charged with violating the Computer
Fraud and Abuse Act (“CFAA”). EF Cultural Travel Bv v. Explorica, 274 F.3d 577, 578 (1st Cir.
2001). Former employees of EF, one of the world’s largest private student travel organizations,
joined Explorica, a company competing in a field of global tours for high school students. Id. at
579. Gormley, former Vice President of Information at EF, now Vice President of Explorica,
believed that, by undercutting EF’s competitive prices on student tours, Explorica could achieve
a substantial advantage over EF and other student tour companies. Id. In order to obtain the
information of EF’s prices, Gormley retained Zefer, Explorica’s Internet consultant to create a
internet computer program that would obtain all the necessary information from EF’s website.
Id. The program focused solely on EF’s website using information that other programs like it
would not have in its possession. Id. Using tour codes, the program easily obtained numerous
amounts of pricing information from EF’s website and inserted them into a spreadsheet. Id. at
579-80. The spreadsheets were then sent to Explorica, which then used the information to
28
undercut EF’s prices. Id. at 580. Explorica then began printing brochures and competing in the
tour market in which EF was participating. Id.
The court found that Explorica and its employees had violated the “exceeded authorized
access,” provision of the CFAA. Id. at 583. While employed at EF, Gormley had signed a
confidentiality agreement. Id. at 582. The agreement prohibited Gormley from disclosing any
confidential information of EF to a third party. Id. Additionally, the agreement prohibited
Gormley from using EF’s confidential information for his own benefit or for the benefit of
another person or business. Id. The agreement defined such information as any information that
“the use or disclosure of which might reasonably be construed to be contrary to the interests of
EF.” Id. Gormley had used some of the information he obtained as an employee at EF and
communicated it to Zefer in order to create the program that obtained EF’s pricing information to
compete with EF in the marketplace. Id. at 582-83. However, the court indicated that by holding
Explorica and its employees had exceeded authorized use, they did not go into the “general
arguments made about statutory meaning, including whether use of [the program] alone renders
access unauthorized.” Id. at 581-82.
In United States v. Rodriguez, Rodriguez was charged with violating the Computer Fraud
and Abuse Act (“CFAA”). United States v. Rodriguez, 628 F.3d 1258, 1260 (11th Cir. 2010).
Rodriguez worked as a representative for the Social Security Administration (“SSA”). Id. His
responsibilities was to answer questions from the general public about social security benefits
over the telephone. Id. As an representative, Rodriguez had access to the SSA’s databases that
contained sensitive personal information. Id. The SSA established a policy that prohibited
Rodriguez from obtaining SSA database information without a business reason. Id. Rodriguez
had accessed the personal information of a number of individuals for nonbusiness reasons. Id. at
29
1260-1262. The SSA alleges Rodriguez had exceeded his authorized access to the database. Id.
at 1260.
The court held Rodriguez had exceeded his authorized access to the SSA’s database. Id.
at 1263. Rodriguez conceded that he accessed information that was unauthorized. Id. The SSA
had informed Rodriguez that he could not obtain personal information for nonbusiness reasons.
Id. The court used the “plain language” of the CFAA to come to its decision. Id. at 1263-64.
In United States v. John, John was charged with violating the Computer Fraud and Abuse
Act (“CFAA”). United States v. John, 597 F.3d 263, 270 (5th Cir. 2010). John worked as an
account manager at Citigroup. Id. at 269. As an employee of Citigroup, John had access to
Citigroup’s internal computer system and customer account information. Id. John gave her half-
brother multiple customer account information so that he and others could incur fraudulent
charges. Id. at 269.
The court held John had exceeded her authorized access. Id. Citigroup’s policies
specifically prohibited the misuse of the company’s internal computer systems and confidential
customer information. Id. at 272. Despite those policies, John accessed customer information and
account information that she did not manage and used the highly sensitive and confidential
information to perpetuate fraud on Citigroup and its customers. Id.
Applying the the broad interpretations applied in Explorica, Rodriguez, and John in
holding the respective defendants had violated the CFAA by violating employer restrictions will
result in far-reaching effects that Congress did not intend. The broad interpretation “bases
authorization on the whim of the employee at the given moment he or she uses a computer.”
Jones, 957 F. Supp.2d at 618-19. Additionally, an employee’s liability under the CFAA would
unlikely be altered merely because the employee’s mental state shifts from “‘loyal employee’” to
30
“‘disloyal competitor.’” LVRC Holdings, LLC. v. Brekka, 581 F.3d 1127, 1134 (9th Cir. 2009).
Furthermore, it would “criminalize a broad range of day-to-day activity” and subject individuals
to the “risk of arbitrary or discriminatory prosecution and conviction.” Nosal 676 F.3d at 862
(citing United States v. Kozminski, 487 U.S. 931, 949 (1988)). Its application could be applied to
an employee who logs onto Facebook or checks sports scores, resulting in a termination of the
agency relationship. WEC Carolina Energy Solutions, LLC. v. Miller, 687 F.3d 199, 206 (4th
Cir. 2012). The CFAA fails to even mention agency or loyalty principles. Jones, 957 F. Supp. 2d
at 619.
The effect of the broad interpretation would be detrimental because courts would be
required to decipher the moments in which a single employee’s interests weave in and out of
alignment with the employer. The CFAA specifically differentiates authorization language
between accessing a computer without authority or exceeding initially permitted access. Such
broad interpretations would allow for removal of all distinctions between “without authorization”
and “exceeds authorization.” Therefore, the broad interpretation should not be applied.
III. THE AGGREGATE USE OF THE POLE CAMERA, LICENSE PLATE
SCANNER, AND QUADROCOPTER DRONE WAS AN UNREASONABLE
SEARCH UNDER THE FOURTH AMENDMENT BECAUSE THE
INFORMATION OBTAINED AS A WHOLE VIOLATED LEOMUND’S
REASONABLE EXPECTATION OF PRIVACY
The Fourth Amendment of the United States Constitution prohibits the government from
conducting unreasonable searches and seizures of individuals and their property. U.S. CONST.
amend. IV. An unreasonable search occurs when the government violates an individual’s
reasonable expectation of privacy. United States v. Jones, 132 S.Ct. 945, 951 (2012). An
individual’s expectation of privacy is reasonable if society is prepared to recognize it as
reasonable. Kyllo v. United States, 533 U.S. 27, 34 (2001); Katz v. United States, 389 U.S. 347,
31
361 (1967) (Harlan, J., concurring). When the government search involves surveillance through
technology, and not physical trespass, such search is subject to the reasonable expectation of
privacy analysis. Jones, 132 S. Ct. at 953 (2012). Therefore, because the extended surveillance of
Leomund violated his reasonable expectation of privacy, the surveillances, as a whole, was an
unreasonable search under the Fourth Amendment.
A. The Advancement Of Modern Technology Requires The Adoption Of The
Mosaic Approach To The Reasonable Expectation Of Privacy Analysis.
In Jones, Jones was charged with conspiracy to distribute and possess with intent to
distribute cocaine. Jones, 132 S.Ct. at 948. In order to obtain evidence against Jones, officers
obtained a warrant to install a Global Positioning System (“GPS”) tracking device on his vehicle
in the District of Columbia for 10 days. Id. However, the officers installed the device on the 11th
day in Maryland. Id. The officers used the device to track the vehicle’s movements over the next
28 days. Id. The information obtained relayed more than 2,000 pages of data over a 4-week
period. Id.
The Court held there was a “search” under the Fourth Amendment because the
installation of the GPS was a physical intrusion, and, therefore, the Katz analysis did not need to
be applied. Id. at 949-50. However, the Court acknowledged that when a particular case involves
the transmission of electronic signals without a physical trespass involved, that case is subject to
the Katz analysis. Id. at 953. The Court left open the question of whether an extended
surveillance of an individual solely through electronic means would constitute a violation of the
Fourth Amendment. Id. at 953-54. It is to this question that Justices Alito and Sotomayor provide
some guidance. Id. at 954-57 (Sotomayor, J., concurring); Id. at 963-64 (Alito, J., concurring).
The Fourth Amendment must “cease to treat secrecy as a prerequisite for privacy.” Id. at
957. (Sotomayor, J., concurring). In today’s society, technology, including the GPS, reveals so
32
much information about an individual that, if aggregated, the government could determine an
individual’s “familial, political, professional, religious, and sexual associations.” Id. at 955
(citing New York v. Weaver, 909 N.E.2d 1195, 1199 (N.Y. 2009)). However, while some people
may accept the “increased convenience or security” that the technology may provide “at the
expense of privacy,” others may come to understand that such a development is “inevitable[,]”
and, therefore, accept the “tradeoff.” Jones, 132 S.Ct. at 962 (Alito, J., concurring). The
emergence of new technology “will continue to shape the average person’s expectations about
the privacy of his or her daily movements.” Id. at 963. The prolonged use of a GPS to monitor
and investigate an individual “[for] most offenses impinges on expectations of privacy.” Id. at
964. Society would expect that the government would not and could not “secretly monitor and
catalogue every single movement of an individual’s car for a very long period.” Id. The use of
the GPS to track Jones’ every move for four weeks constitutes a “search” under the Fourth
Amendment. Id.
In Weaver, Weaver was convicted of burglarizing a K-Mart Store. Weaver, 909 N.E.2d at
1195. Police officers attached a global positioning system (GPS) to the bumper of Weaver’s van.
Id. The GPS worked in conjunction with numerous satellites, from which received tracking data,
to fix the location of Weaver’s van. Id. The GPS indicated the van’s speed and pinpointed its
location within 30 feet. Id. The GPS readings indicated the speed and location of Weaver’s van
approximately every minute while the van was in motion. Id. The readings were less often when
the van was stationary. Id. In order for the police officers to download the GPS information, they
would drive by Weaver’s van and press a button on a unit in their possession. Id. Upon the press
of the button, the tracking history was transmitted to and saved by a computer in the officer’s
vehicle. Id. The GPS was used for 65 days. Id. The GPS indicated that Weaver had been around
33
the store’s location around 7:26 traveling at a speed of six miles per hour. Id. The prosecution
had the GPS readings admitted at trial against Weaver. Id.
The court held that such a “dragnet use” of the GPS to track Weaver for 65 days was “not
consistent with the values at the core of [the New York] Constitution’s prohibition against
unreasonable searches.” Id. at 1203. Using the GPS to monitor an individual for extended
periods of time reveals “with breathtaking quality and quantity . . . a highly detailed profile, not
simply of where [the individual] go[es], but by easy inference, of [the individual’s]
associations—political, religious, amicable and amorous, to name only a few—and of the pattern
of [the individual’s] professional and avocational pursuits.” Id. at 1199-1200. The sorts of
information revealed by the GPS include trips that are “indisputably private [in] nature of which
takes little imagination to conjure . . . .” Id. at 1199. With such technology at the government’s
disposal, “[t]he whole of a person’s progress through the world, into both public and private
spatial spheres, can be charted and recorded over lengthy periods . . . .” Id. Now, prolonged
tracking is “not merely possible[,] but entirely practicable . . . .” Id.
The extended surveillance of Leomund is the manifestation of the concerns of
concurrences in Jones, and the majority in Weaver. Officers were able to learn a great deal about
Leomund that, when considered as a whole, reveals so much about his character that it infringes
on his expectation of privacy. First, federal law enforcement officers set up a telephone pole
camera outside of Leomund’s property. J.A. 15. For five (5) days, the officers received
uninterrupted video of everything that occurred on Leomund’s property. Id. On two separate
occasions, they were able to observe pizza delivered to Leomund’s residence. Id. On a single
occasion, they observed Chinese food being delivered to Leomund’s residence. Id. On three
separate occasions, they observed FedEx delivering packages to Leomund’s residence. Id.
34
During those five (5) days, based on these observations, they could tell Leomund had a taste for
pizza and Chinese food. Additionally, they could tell that he had either purchased something or
had something purchased for him because of the FedEx deliveries. Neither of these observations
give any indication that Leomund had anything to do with the leaked information about the
Phyresis pathogen. After the five-day video footage turned up unsuccessful, officers decided to
use license plate scanners to indicate when Leomund had passed their vehicles. Id. For ten (10)
days, officers received notifications anytime Leomund was traveling somewhere and where he
was going at that particular time. Id. On two separate occasions, officers were notified that
Leomund was at a local grocery store. Id. On a single occasion, officers were notified that
Leomund was at a urologist’s office. Id. On two separate occasions, officers were notified that
Leomund was at a psychiatrist’s office. Id. On a single occasion, officers were notified that
Leomund was at a restaurant. Id. On three separate occasions, officers were notified that
Leomund was at a gentlemen’s club in surrounding towns. Id. On three separate occasions,
officers were notified that Leomund was driving on state roadways, one of which was near his
residence. Id. During those ten (10) days, officers learned that Leomund needed groceries, had
physical and mental issues, was hungry, and possibly needed sexual stimulation. Neither of these
observations give any indication that Leomund had anything to do with the leaked information
about the Phyresis pathogen. Instead, these observations revealed unquestionably private details
of Leomund’s life. Third, Officer Armando was sent to Leomund’s residence to monitor the area
and remain there to report anything unusual. Id. One (1) day later, Officer Armando observed a
Black Sedan that was not registered to Leomund enter onto Leomund’s property. Id. at 16. Based
on Officer Armando’s observations, federal agents dispatched an unmanned quadrocopter drone
to Leomund’s property. Id. It was equipped with a digital camera that transmitted live video. Id.
35
It was used for twenty (20) minutes and surveyed the area at an altitude of 400 feet. Id. Using the
cameras “zoom in” capabilities, the officers were able to see Leomund and Edgeworth using the
CDC’s disease maps. Id. It was not until this point that the officers had something indicating
Leomund has something to do with the leaks and that they decided to obtain a warrant. Id. In
total, officers monitored Leomund for sixteen (16) days and twenty minutes (20) without a
warrant. Allowing that amount of extended surveillance, only to have something relevant on day
16, is a clear violation of Leomund’s expectation of privacy that society would consider
reasonable.
B. The Supreme Court’s Previous Technology-Based Decisions Do Not Apply
Because The Pole Camera, License Plate Scanners, and Quadrocopter Drone
Revealed Far More Information Than The Technology At Issue In Those
Cases
In United States v. Knotts, Knotts, Armstrong, and Petschen were charged with
conspiracy to manufacture controlled substances. United States v. Knotts, 460 U.S. 276, 277
(1983). 3M, Co., a chemical manufacturer had contacted narcotics investigators that Armstrong,
a former employee had been stealing chemicals which could be used to manufacture illicit drugs.
Id. at 278. Visual surveillance revealed Armstrong would steal the chemicals and purchase
chemicals from Hawkins Chemical Co., another chemical manufacture. Id. Armstrong delivered
those chemicals to Petschen. Id. With the consent of Hawkins Chemical, narcotics investigators
installed a beeper inside a container of chloroform, a chemical used to manufacture the illicit
drugs. Id. Hawkins Chemical agreed to sell that particular container to Armstrong. Id. When
Armstrong purchased the container, he placed it in his vehicle and drove to another location. Id.
The investigators followed Armstrong’s car by maintaining contact through the use of visual
surveillance and a monitor receiving the signals from the beeper. Id. Armstrong delivered the
container to Petschen at Petschen’s home. Id. Petschen took the container, placed it in his
36
vehicle, and drove to another location. Id. The investigators followed Petschen, who began
taking evasive measures, causing investigators to lose visual surveillance. Id. However, the
investigators were able to obtain a signal from the beeper, indicating its location at Knotts’ cabin.
Id. Investigators obtained a search warrant for Knotts’ cabin, where they discovered drug
laboratory equipment, drug chemicals, and the chloroform container. Id. at 279.
The Court held the installation of the beeper was not a “search” under the Fourth
Amendment. Id. at 285. The surveillance conducted by the investigators through the use of the
beeper was principally the following of an automobile on public roads. Id. at 281. An individual
has a “lesser expectation of privacy” when he uses an automobile on public roads. Id. (quoting
Cardwell v. Lewis, 417 U.S. 583, 590 (1974) (plurality opinion)). By traveling on public roads,
Petschen’s direction of travel and destination were “conveyed to anyone who wanted to look . . .
.” Knotts, 460 U.S. at 281-82. Additionally, although Knotts had an expectation of privacy in
activity that occurred in his cabin, he had no reasonable expectation of privacy “to the visual
observation of Petschen’s automobile arriving on his premises after leaving a public highway,
nor to movements of objects such as the drum of chloroform outside the cabin in the ‘open
fields.’” Id. at 282 (quoting Hester v. United States, 265 U.S. 57 (1924)). Visual surveillance
from public areas would have revealed all of the information that the beeper revealed. Knotts,
460 U.S. at 282. However, the court limited their holding to the brief surveillance that occurred
in the facts before it. Knotts argued that the Court’s holding would permit longer surveillance
without judicial approval. Id. at 283-84. rejecting the argument, the Court reasoned that “the
‘reality hardly suggests abuse,’ . . . [for] if such dragnet-type law enforcement practices as
[Knotts] envisions should eventually occur, there will be time enough then to determine whether
37
different constitutional principles may be applicable. Id. at 283-84 (quoting Zurcher v. Standford
Daily, 436 U.S. 547, 566 (1978)).
In California v. Ciraolo, Ciraolo was charged with the cultivation of marijuana.
California v. Ciraolo, 476 U.S. 207, 210 (1986). Police officers received an anonymous tip that
Ciraolo was growing marijuana in his backyard. Id. at 209. When the officers went to
investigate, they were unable to observe what was going on in Ciraolo’s backyard from ground
level because there was a 6-foot outer fence and a 10-foot inner fence completely enclosing the
yard. Id. Officers obtained a private plane and flew over Ciraolo’s house from 1,000 feet in the
area. Id. The officers were able to identify the marijuana plants from the plane and took a picture
of the area with a standard 35mm camera. Id. Based on the tip and the observations, officers
obtained a search warrant and seized the marijuana. Id. at 209-10.
The Court held Ciraolo had no reasonable expectation of privacy in his yard when the
officers observed the marijuana from navigable airspace. Id. at 214-15. Although Ciraolo’s yard
was a party of the curtilage of his home, that itself does not bar all police observations. Id. at
213. Additionally, Ciraolo’s attempts to prevent his activity from being seen does not prohibit
police observations from areas where they “a right to be and which renders the activities clearly
visible.” Id. (citing Knotts, 460 U.S. at 282). The Fourth Amendment does not protect the
activities an individual knows has been exposed to the public. Ciraolo, 476 U.S. at 213 (quoting
Katz, 389 U.S. at 347).
In Florida v. Riley, Riley was charged with possession of marijuana. Florida v. Riley, 488
U.S. 445, 449 (1989). The Sheriff’s office received an anonymous tip that Riley was growing
marijuana in a greenhouse on his property. Id. at 448. When an officer sought to investigate
Riley’s property, he was unable to see the contents of Riley’s greenhouse from the road because
38
of the surrounding trees, shrubs, and Riley’s motor home. Id. Additionally, Riley’s greenhouse
was covered by roofing panels. Id. The officer obtained a helicopter and flew above Riley’s
property at the height of 400 feet. Id. While flying in the air, the officer noticed the greenhouse
had two roof panels, approximately 10 percent of the roofing area, missing. Id. Using his naked
eye, the officer could see through the opening of the roof and identify what he believed to be
marijuana growing inside of it. Id. The officer obtained a warrant based on his observations and
searched the greenhouse, which indeed contained marijuana. Id. at 449.
Using the rationale of California v. Ciraolo, the Court held that Riley had no expectation
of privacy when the officer observed the marijuana from navigable airspace. Id. at 450-51. The
marijuana was viewable from the air as a result of the missing roof panels. Id. at 450. Since
private and commercial flights are routine in the United States, and that such flights were not
unheard of where Riley resided, he had no expectation of privacy when anyone from the public
could observe from the navigable airspace the marijuana he was growing. Id. at 450-51. The
helicopter was flying within the bounds of the law and navigable airspace. Id. at 451.
Additionally, no intimate details of the home or curtilage had been observed by the officer. Id. at
452.
The “dragnet-type” of surveillance the Court noted in Knotts has occurred in Leomund’s
case. Unlike the surveillances in Knotts, Ciraolo, and Riley, the surveillance of Leomund by
federal officers lasted extended far beyond a single destination and beyond a single day. Officers
monitored Leomund for sixteen (16) days, observing Leomund going to several different
locations, all of which did not implicate he had anything to do with leaking the information about
the Phyresis pathogen. Additionally, the surveillance in Knotts did not reveal private details of
the defendant’s life. The sixteen (16) day surveillance revealed a number of private details of
39
Leomund’s life, from visiting a urologist and psychiatrist’s office, to attending a gentlemen’s
club. Id. at 15. It was not until day sixteen that federal officers had specific evidence that
Leomund had anything to do with the leak of the Phyresis pathogen. Prior to that time,
Leomund’s private affairs became known to the federal officers, all of which were irrelevant to
the access of CDC-Secure.
CONCLUSION
Therefore, because Leomund did not access CDC-Secure “without authorization,” and
did not “exceed [his] authorized access” under the plain meaning of the term “authorization,”
Leomund did not violate the CFAA. Additionally, because the aggregate use of the pole camera,
license plate scanner, and quadrocopter drone violated Leomund’s reasonable expectation of
privacy, an unreasonable search has occurred, in violation of the Fourth Amendment. We
respectfully request that this Court reverse the the holding of the United States Court of Appeals
for the Fourteenth Circuit.

Mais conteúdo relacionado

Mais procurados

Cyber appellate tribunal
Cyber appellate tribunalCyber appellate tribunal
Cyber appellate tribunalAnkita Sharma
 
Cyber Crimeand Cyber Laws
Cyber Crimeand Cyber LawsCyber Crimeand Cyber Laws
Cyber Crimeand Cyber LawsSuryakanta Rout
 
20211027 sc order in pegasus case
20211027 sc order in pegasus case20211027 sc order in pegasus case
20211027 sc order in pegasus casesabrangsabrang
 
Cyber jurisdiction in India
Cyber jurisdiction in IndiaCyber jurisdiction in India
Cyber jurisdiction in Indiashamvisingh
 
Cyber Law
Cyber LawCyber Law
Cyber Lawihah
 
Cyberspace jurisdiction meaning and concept
Cyberspace jurisdiction meaning and conceptCyberspace jurisdiction meaning and concept
Cyberspace jurisdiction meaning and conceptgagan deep
 
Nadeem cyber law assignment
Nadeem cyber law assignmentNadeem cyber law assignment
Nadeem cyber law assignmentNadeem Kazi
 
Information technology Act with Cyber offences .pptx
Information technology Act with Cyber offences .pptxInformation technology Act with Cyber offences .pptx
Information technology Act with Cyber offences .pptxRahul Bharati
 
nullcon 2010 - Comparative analysis of “The IT Act, 2000″ and The IT(amendmen...
nullcon 2010 - Comparative analysis of “The IT Act, 2000″ and The IT(amendmen...nullcon 2010 - Comparative analysis of “The IT Act, 2000″ and The IT(amendmen...
nullcon 2010 - Comparative analysis of “The IT Act, 2000″ and The IT(amendmen...n|u - The Open Security Community
 
Information Technology Act 2000
Information Technology Act 2000Information Technology Act 2000
Information Technology Act 2000Vijay Dalmia
 
Law relating to information technology
Law relating to information technologyLaw relating to information technology
Law relating to information technologyDr. Trilok Kumar Jain
 
Section 66 of Information Technology Act.
Section 66 of Information Technology Act.Section 66 of Information Technology Act.
Section 66 of Information Technology Act.anveshika thakur
 
Cyber law case Assignment
Cyber law case AssignmentCyber law case Assignment
Cyber law case Assignment9945446746
 

Mais procurados (20)

Cyber appellate tribunal
Cyber appellate tribunalCyber appellate tribunal
Cyber appellate tribunal
 
Cyber Crimeand Cyber Laws
Cyber Crimeand Cyber LawsCyber Crimeand Cyber Laws
Cyber Crimeand Cyber Laws
 
20211027 sc order in pegasus case
20211027 sc order in pegasus case20211027 sc order in pegasus case
20211027 sc order in pegasus case
 
Cyber jurisdiction in India
Cyber jurisdiction in IndiaCyber jurisdiction in India
Cyber jurisdiction in India
 
Cyber law nepal
Cyber law nepalCyber law nepal
Cyber law nepal
 
Cyber space: its legal jurisdiction
Cyber space: its legal jurisdictionCyber space: its legal jurisdiction
Cyber space: its legal jurisdiction
 
Cyber law cases
Cyber law casesCyber law cases
Cyber law cases
 
Cyber law final
Cyber law finalCyber law final
Cyber law final
 
Cyber Law
Cyber LawCyber Law
Cyber Law
 
Cyber crime
Cyber crimeCyber crime
Cyber crime
 
Cyber crime 1
Cyber crime 1Cyber crime 1
Cyber crime 1
 
Cyberspace jurisdiction meaning and concept
Cyberspace jurisdiction meaning and conceptCyberspace jurisdiction meaning and concept
Cyberspace jurisdiction meaning and concept
 
Nadeem cyber law assignment
Nadeem cyber law assignmentNadeem cyber law assignment
Nadeem cyber law assignment
 
Information technology Act with Cyber offences .pptx
Information technology Act with Cyber offences .pptxInformation technology Act with Cyber offences .pptx
Information technology Act with Cyber offences .pptx
 
nullcon 2010 - Comparative analysis of “The IT Act, 2000″ and The IT(amendmen...
nullcon 2010 - Comparative analysis of “The IT Act, 2000″ and The IT(amendmen...nullcon 2010 - Comparative analysis of “The IT Act, 2000″ and The IT(amendmen...
nullcon 2010 - Comparative analysis of “The IT Act, 2000″ and The IT(amendmen...
 
Information Technology Act 2000
Information Technology Act 2000Information Technology Act 2000
Information Technology Act 2000
 
Law relating to information technology
Law relating to information technologyLaw relating to information technology
Law relating to information technology
 
Section 66 of Information Technology Act.
Section 66 of Information Technology Act.Section 66 of Information Technology Act.
Section 66 of Information Technology Act.
 
Cyber law case Assignment
Cyber law case AssignmentCyber law case Assignment
Cyber law case Assignment
 
Cyber law
Cyber lawCyber law
Cyber law
 

Destaque

Jadwal praktikum ipa
Jadwal praktikum ipaJadwal praktikum ipa
Jadwal praktikum ipatrisachmad
 
Despacho de Moro sobre prisão de Eduardo Cunha
Despacho de Moro sobre prisão de Eduardo CunhaDespacho de Moro sobre prisão de Eduardo Cunha
Despacho de Moro sobre prisão de Eduardo CunhaJamildo Melo
 
Proposal photographer virginia
Proposal photographer virginiaProposal photographer virginia
Proposal photographer virginiafordcoppenz
 
Hosting Linux, hosting Windows e Joomla
Hosting Linux, hosting Windows e JoomlaHosting Linux, hosting Windows e Joomla
Hosting Linux, hosting Windows e Joomlawebhostingguy
 
Фіскальна стійкість як підґрунтя для інноваційного розвитку економіки
Фіскальна стійкість як підґрунтя для інноваційного розвитку економікиФіскальна стійкість як підґрунтя для інноваційного розвитку економіки
Фіскальна стійкість як підґрунтя для інноваційного розвитку економікиДана Яковенко
 
Бондарук Роман - Фонд "Реформи ЖКГ" м.Луцьк 2016
Бондарук Роман - Фонд "Реформи ЖКГ" м.Луцьк 2016Бондарук Роман - Фонд "Реформи ЖКГ" м.Луцьк 2016
Бондарук Роман - Фонд "Реформи ЖКГ" м.Луцьк 2016forum-osbb
 
Interview met Jorieke over functie top600 in Z&W
Interview met Jorieke over functie top600 in Z&WInterview met Jorieke over functie top600 in Z&W
Interview met Jorieke over functie top600 in Z&WJorieke de Wit
 
In tray presentation
In tray presentationIn tray presentation
In tray presentationAdrian Hines
 
Seminario cerámicas vs metal cerámicas
Seminario cerámicas vs metal cerámicasSeminario cerámicas vs metal cerámicas
Seminario cerámicas vs metal cerámicasDavid Campoverde
 
організація батьківських зборів
організація батьківських зборіворганізація батьківських зборів
організація батьківських зборівTeslevych
 
Descriptive Text
Descriptive TextDescriptive Text
Descriptive TextJawa Timur
 

Destaque (13)

Jadwal praktikum ipa
Jadwal praktikum ipaJadwal praktikum ipa
Jadwal praktikum ipa
 
Despacho de Moro sobre prisão de Eduardo Cunha
Despacho de Moro sobre prisão de Eduardo CunhaDespacho de Moro sobre prisão de Eduardo Cunha
Despacho de Moro sobre prisão de Eduardo Cunha
 
Proposal photographer virginia
Proposal photographer virginiaProposal photographer virginia
Proposal photographer virginia
 
Seminario 13
Seminario 13Seminario 13
Seminario 13
 
Hosting Linux, hosting Windows e Joomla
Hosting Linux, hosting Windows e JoomlaHosting Linux, hosting Windows e Joomla
Hosting Linux, hosting Windows e Joomla
 
Фіскальна стійкість як підґрунтя для інноваційного розвитку економіки
Фіскальна стійкість як підґрунтя для інноваційного розвитку економікиФіскальна стійкість як підґрунтя для інноваційного розвитку економіки
Фіскальна стійкість як підґрунтя для інноваційного розвитку економіки
 
Бондарук Роман - Фонд "Реформи ЖКГ" м.Луцьк 2016
Бондарук Роман - Фонд "Реформи ЖКГ" м.Луцьк 2016Бондарук Роман - Фонд "Реформи ЖКГ" м.Луцьк 2016
Бондарук Роман - Фонд "Реформи ЖКГ" м.Луцьк 2016
 
6 choices 2015 BDC only
6 choices 2015 BDC only6 choices 2015 BDC only
6 choices 2015 BDC only
 
Interview met Jorieke over functie top600 in Z&W
Interview met Jorieke over functie top600 in Z&WInterview met Jorieke over functie top600 in Z&W
Interview met Jorieke over functie top600 in Z&W
 
In tray presentation
In tray presentationIn tray presentation
In tray presentation
 
Seminario cerámicas vs metal cerámicas
Seminario cerámicas vs metal cerámicasSeminario cerámicas vs metal cerámicas
Seminario cerámicas vs metal cerámicas
 
організація батьківських зборів
організація батьківських зборіворганізація батьківських зборів
організація батьківських зборів
 
Descriptive Text
Descriptive TextDescriptive Text
Descriptive Text
 

Semelhante a CFAA & Fourth Amendment Writing Sample

The CFAA and Aarons Law
The CFAA and Aarons LawThe CFAA and Aarons Law
The CFAA and Aarons LawThomas Jones
 
RESEARCH - STUDIES IN CONSTITUTIONAL LAW
RESEARCH  - STUDIES IN CONSTITUTIONAL LAWRESEARCH  - STUDIES IN CONSTITUTIONAL LAW
RESEARCH - STUDIES IN CONSTITUTIONAL LAWChirine Haddad ?
 
Computer Fraud and Abuse Act
Computer Fraud and Abuse ActComputer Fraud and Abuse Act
Computer Fraud and Abuse ActStefanMartinez6
 
What is criminal breach of trust in IPR
What is criminal breach of trust in IPRWhat is criminal breach of trust in IPR
What is criminal breach of trust in IPRPranav Gupta
 
Motion for Preliminary Injunction
Motion for Preliminary InjunctionMotion for Preliminary Injunction
Motion for Preliminary Injunctionawc166
 
Privacy in the Workplace: Electronic Surveillance under State and Federal Law
Privacy in the Workplace: Electronic Surveillance under State and Federal LawPrivacy in the Workplace: Electronic Surveillance under State and Federal Law
Privacy in the Workplace: Electronic Surveillance under State and Federal LawCharles Mudd
 
Yar Chaikovsky ABA Section of Intellectual Property Law Division VII — Infor...
Yar Chaikovsky ABA Section of Intellectual Property Law  Division VII — Infor...Yar Chaikovsky ABA Section of Intellectual Property Law  Division VII — Infor...
Yar Chaikovsky ABA Section of Intellectual Property Law Division VII — Infor...Yar Chaikovsky
 
Unit 3 Cyber Crimes and Torts 8 hr
Unit 3 Cyber Crimes and Torts 8 hrUnit 3 Cyber Crimes and Torts 8 hr
Unit 3 Cyber Crimes and Torts 8 hrTushar Rajput
 
York County, Virginia General District Court Filing Traffic Court
York County, Virginia General District Court Filing   Traffic CourtYork County, Virginia General District Court Filing   Traffic Court
York County, Virginia General District Court Filing Traffic CourtChuck Thompson
 
Cyber defamation
Cyber defamationCyber defamation
Cyber defamationTuhin Batra
 
Commercial Privacy Bill of Rights PDF
Commercial Privacy Bill of Rights PDFCommercial Privacy Bill of Rights PDF
Commercial Privacy Bill of Rights PDFDailyHostNews
 
Legal Issues in Mobile Security Research
Legal Issues in Mobile Security ResearchLegal Issues in Mobile Security Research
Legal Issues in Mobile Security Researchmarciahofmann
 
Хакер Банни подал в суд на правительство США
Хакер Банни подал в суд на правительство СШАХакер Банни подал в суд на правительство США
Хакер Банни подал в суд на правительство СШАAnatol Alizar
 

Semelhante a CFAA & Fourth Amendment Writing Sample (20)

The CFAA and Aarons Law
The CFAA and Aarons LawThe CFAA and Aarons Law
The CFAA and Aarons Law
 
Legal Issues in Mobile Security Research
Legal Issues in Mobile Security ResearchLegal Issues in Mobile Security Research
Legal Issues in Mobile Security Research
 
RESEARCH - STUDIES IN CONSTITUTIONAL LAW
RESEARCH  - STUDIES IN CONSTITUTIONAL LAWRESEARCH  - STUDIES IN CONSTITUTIONAL LAW
RESEARCH - STUDIES IN CONSTITUTIONAL LAW
 
Privacy and Privacy Law in India By Prashant Mali
Privacy and Privacy Law in India By Prashant MaliPrivacy and Privacy Law in India By Prashant Mali
Privacy and Privacy Law in India By Prashant Mali
 
Computer Fraud and Abuse Act
Computer Fraud and Abuse ActComputer Fraud and Abuse Act
Computer Fraud and Abuse Act
 
What is criminal breach of trust in IPR
What is criminal breach of trust in IPRWhat is criminal breach of trust in IPR
What is criminal breach of trust in IPR
 
Miranda Burr
Miranda BurrMiranda Burr
Miranda Burr
 
Introduction to cyber law.
Introduction to cyber law. Introduction to cyber law.
Introduction to cyber law.
 
Motion for Preliminary Injunction
Motion for Preliminary InjunctionMotion for Preliminary Injunction
Motion for Preliminary Injunction
 
Privacy in the Workplace: Electronic Surveillance under State and Federal Law
Privacy in the Workplace: Electronic Surveillance under State and Federal LawPrivacy in the Workplace: Electronic Surveillance under State and Federal Law
Privacy in the Workplace: Electronic Surveillance under State and Federal Law
 
Yar Chaikovsky ABA Section of Intellectual Property Law Division VII — Infor...
Yar Chaikovsky ABA Section of Intellectual Property Law  Division VII — Infor...Yar Chaikovsky ABA Section of Intellectual Property Law  Division VII — Infor...
Yar Chaikovsky ABA Section of Intellectual Property Law Division VII — Infor...
 
Unit 3 Cyber Crimes and Torts 8 hr
Unit 3 Cyber Crimes and Torts 8 hrUnit 3 Cyber Crimes and Torts 8 hr
Unit 3 Cyber Crimes and Torts 8 hr
 
Lawfully Avoiding Government Obligations Course, Form #12.040
Lawfully Avoiding Government Obligations Course, Form #12.040Lawfully Avoiding Government Obligations Course, Form #12.040
Lawfully Avoiding Government Obligations Course, Form #12.040
 
York County, Virginia General District Court Filing Traffic Court
York County, Virginia General District Court Filing   Traffic CourtYork County, Virginia General District Court Filing   Traffic Court
York County, Virginia General District Court Filing Traffic Court
 
Cyber defamation
Cyber defamationCyber defamation
Cyber defamation
 
Commercial Privacy Bill of Rights PDF
Commercial Privacy Bill of Rights PDFCommercial Privacy Bill of Rights PDF
Commercial Privacy Bill of Rights PDF
 
Legal Issues in Mobile Security Research
Legal Issues in Mobile Security ResearchLegal Issues in Mobile Security Research
Legal Issues in Mobile Security Research
 
Defending Securities Fraud
Defending Securities FraudDefending Securities Fraud
Defending Securities Fraud
 
Cybercrime
CybercrimeCybercrime
Cybercrime
 
Хакер Банни подал в суд на правительство США
Хакер Банни подал в суд на правительство СШАХакер Банни подал в суд на правительство США
Хакер Банни подал в суд на правительство США
 

CFAA & Fourth Amendment Writing Sample

  • 1. 16 (N.Y. 2009)). With such technology at the government’s disposal, “[t]he whole of a person’s progress through the world, into both public and private spatial spheres, can be charted and recorded over lengthy periods . . . .” Weaver, 909 N.E.2d at 1195. Now, prolonged tracking is “not merely possible[,] but entirely practicable . . . .” Id. The emergence of such technology “will continue to shape the average person’s expectations about the privacy of his or her daily movements.” Jones, 132 S.Ct. at 963 (Alito, J., concurring). The Supreme Court’s previous technology-based decisions do not apply because the extended surveillance of Leomund by federal officers lasted far beyond a single destination and beyond a single day. In total, officers monitored Leomund for sixteen (16) days and twenty minutes (20) without a warrant. J.A. 15-16. The sixteen (16) day surveillance revealed a number of private details of Leomund’s life, from visiting a urologist and psychiatrist’s office, to attending a gentlemen’s club. Id. at 15. It was not until day sixteen that federal officers had specific evidence that Leomund had anything to do with the leak of the Phyresis pathogen. Id. at 16. Prior to that time, Leomund’s private affairs became known to the federal officers, all of which were irrelevant to the access of CDC-Secure. Id. at 15. Allowing that amount of extended surveillance, only to have something relevant on day 16, is a clear violation of Leomund’s expectation of privacy that society would consider reasonable. Therefore, an unreasonable search has occurred, in violation of the Fourth Amendment. ARGUMENT I. LEOMUND DID NOT VIOLATE THE COMPUTER FRAUD AND ABUSE ACT BECAUSE THE TERM “WITHOUT AUTHORIZATION” ONLY CONTEMPLATES UNAUTHORIZED ACCESS, NOT UNAUTHORIZED USE The Computer Fraud and Abuse Act (“CFAA”) is a federal statute enacted primarily to combat computer hacking. WEC Carolina Energy Solutions, LLC. v. Miller, 687 F.3d 199, 201
  • 2. 17 (4th Cir.2012) (citing A.V. ex rel. Vanderhye v. iParadigms, LLC., 562 F.3d 630, 645 (4th Cir.2009)). The CFAA prohibits a number of crimes relating to computer use, including the prohibition of any individual who “intentionally accesses a computer without authorization . . . .” 18 U.S.C.A. §1030(a)(2). A violation of the CFAA exposes an individual to both criminal and civil liability. Miller, 687 F.3d at 201. However, “authorization” is not defined by the CFAA. In interpreting the meaning and scope of “authorization”, the Fourth and Ninth Circuits apply the narrow interpretation, which requires the plain meaning of the term to be examined. Miller, 687 F.3d at 203; LVRC Holdings v. Brekka, 581 F.3d 1127, 1130, 1132 (9th Cir.2009). In other words, the “‘ordinary, contemporary, [or] common meaning’” of the term will be used. Id. at 1133 (quoting Perrin v. United States, 444 U.S. 37, 42 (1979)). On the other hand, the First, Fifth, Seventh, and Eleventh Circuits apply the broader interpretation. EF Cultural Travel Bv v. Explorica, 274 F.3d 577 (1st Cir. 2001); United States v. John, 597 F.3d 263 (5th Cir. 2010); Int’l Airport Ctrs., LLC v. Citrin, 440 F.3d 418 (7th Cir. 2006); United States v. Rodriguez, 628 F.3d 1258 (11th Cir. 2010). Since the plain language of the CFAA indicates that the only conduct that is clearly covered by the statute is the accessing of a computer “without authorization,” not “unauthorized use,” and Congress did not explicitly prohibit “unauthorized use,” Leomund has not violated the “without authorization” provision of the CFAA. A. The Plain Meaning Of “Without Authorization” Prohibits An Employee From Unlawfully Accessing An Employer’s Computer, Not Unlawfully Using It. In Miller, Miller was charged with violating the Computer Fraud and Abuse Act (“CFAA”). Miller, 687 F.3d at 201. Miller worked as Project Director for WEC Carolina Energy Solutions, Inc. Id. at 202. As an employee of WEC, Miller was given a laptop computer and cell phone. Id. Miller was authorized to access WEC ‘s intranet and computer servers. Id. WEC established policies prohibiting employees from using its information without authorization or
  • 3. 18 downloading the information on a personal computer. Id. However, the policy did not restrict Miller’s authorization to access WEC’s information. Id. Miller resigned from WEC and began working with Arc Energy Services, Inc., WEC’s competitor. Id. at 201. Prior to his resignation, Miller is alleged to have downloaded a number of WEC’s confidential information and emailed them to a personal email address as well as saved them onto a personal computer. Id. at 202. Additionally, Miller is alleged to have used WEC’s information to obtain a potential WEC customer for the benefit of Arc. Id. The customer retained Arc’s services. Id. As a result, WEC alleges that Miller lost all authorization to access WEC’s confidential information when he downloaded WEC information onto his personal computer. Id. The court held Miller did not violate the CFAA. Id. at 207. The CFAA is primarily a criminal statute that was established to combat computer hacking. Id. at 201 (citing iParadigms, LLC., 562 F.3d at 645). However, the CFAA does not define “authorization.” Miller, 687 F.3d at 204. When interpreting the meaning of a term of a statute, “the plain [meaning] of the [term is to be analyzed], seeking ‘first and foremost . . . to implement congressional intent.’” Id. at 203 (quoting United States v. Abdelshafi, 592 F.3d 602, 607 (4th Cir. 2010)). The plain meaning of a term is its “‘ordinary, contemporary, common meaning,’ unless Congress has indicated the term bears a different meaning. Miller, 687 F.3d at 203-04 (quoting Stephens ex rel. R.E. v. Astrue, 565 F.3d 131, 137 (4th Cir. 2009)). If the statute has both civil and criminal application, the interpretation of the term is to be applied “uniformly in both contexts.” Miller, 687 F.3d at 204 (citing Leocal v. Ashcroft, 543 U.S. 1, 11 n.8 (2004)). Since the CFAA is a criminal statute, the terms must be strictly construed in accordance with the rule of lenity, avoiding any interpretations “not ‘clearly warranted by the text[.]’” Miller, 687 F.3d at 204 (quoting Crandon v. United States, 494 U.S. 152, 160 (1990)). The plain meaning of “‘authorization’” is “‘formal
  • 4. 19 warrant, or sanction.’” Miller, 687 F.3d at 204 (quoting Oxford English Dictionary (2d ed. 1989; online version 2012)). The CFAA only covers “unauthorized access of protected computers.” Id. (emphasis added). The plain meaning of “‘access’” is “‘to gain admission to [something].’” Miller, 687 F.3d at 204 (quoting Oxford English Dictionary (3d ed. 2011; online version 2012)). Therefore, based on the plain meanings of “authorization” and “access,” an employee accesses a computer “without authorization” under the CFAA when “he gains admission to a computer without approval.” Miller, 687 F.3d at 204 (citing Brekka, 581 F.3d at 1133). It does not extend to the “improper use of information validly accessed.” Miller, 687 F.3d at 204 (emphasis added). Since Miller had authorized access to WEC’s intranet and computer servers as well as all of WEC’s information stored on the servers, he did not violate the “without authorization” provision of the CFAA. Id. at 207. In Brekka, Brekka was charged with violating the Computer Fraud and Abuse Act (“CFAA”). Brekka, 581 F.3d at 1129. Brekka was hired by LVRC to oversee aspects of it’s residential treatment center for addicted persons. Id. Brekka was to maintaining contact with LOAD, Inc., a company that provided email, website, and related services for the facility. Id. Brekka also was responsible for conducting internet marketing programs. Id. While working for LVRC, Brekka owned and operated two consulting businesses that provided addiction rehabilitation services and referrals to rehabilitation facilities through the use of internet sites and advertisements. Id. The owner of LVRC was aware of Brekka’s business. Id. As an employee of LVRC, Brekka was assigned a computer. Id. However, while commuting to and from his other businesses, Brekka emailed LVRC documents to his personal computer. Id. at 1129-30. There was no policy prohibiting employees from emailing LVRC documents to personal computers. Id. Brekka eventually resigned from LVRC, but continued to access LVRC documents based on the
  • 5. 20 log-in credentials assigned to him by LOAD’s administrator. Id. at 1130. LVRC alleges that Brekka accessed its computers “without authorization” when he emailed the LVRC documents to his personal computer. Id. at 1128. The court held Brekka did not violate the CFAA. Id. at 1137. The CFAA was established to allow the government to prosecute computer crimes, specifically, computer hackers who sought to steal information or interrupt the functionality of computer systems. Id. Interpreting the meaning of “without authorization” requires an analysis of the plain language of the CFAA. Id. at 1132 (citing United States v. Blixt, 548 F.3d 882, 887 (9th Cir. 2008)). When a statute does not define a word, it is a “‘fundamental canon of statutory construction’” that the “‘ordinary, contemporary, [or] common meaning’” of the word be used. Brekka, 581 F.3d at 1133 (quoting Perrin, 444 U.S. at 42). The CFAA is primarily a criminal statute, and when there is ambiguity in a criminal statute, it should be resolved “‘in favor of lenity.’” Brekka, 581 F.3d at 1134 (quoting United States v. Carr, 513 F.3d 1164, 1168 (9th Cir.2008)). When the statute has both criminal and civil implications, it should be interpreted consistently in both contexts. Brekka, 581 F.3d at 1134 (citing Ashcroft, 543 U.S. at 11 n.8 (2004)). The plain meaning of “authorization” applies when an individual is “‘authorized’” to access the company’s computer. Brekka, 581 F.3d at 1134 (quoting Webster’s Third International Dictionary, 146 (2002)). Therefore, under the CFAA, “without authorization” occurs when an employee “accesses a computer without any permission at all . . . .” Brekka, 581 F.3d at 1134. Additionally, an employee accesses a computer “without authorization” when his prior authorization to access the computer was rescinded by his employer, but he uses it anyway. Id. at 1135. Since there was no dispute that Brekka was authorized to access and use LVRC’s computer, he did not violate the “without authorization” provision of the CFAA. Id. at 1133.
  • 6. 21 Like the defendants in Miller and Brekka, Leomund was granted access to CDC-Secure while employed at the CDC. J.A. 14. Although there was a restriction as to the disclosure of the information contained in CDC-Secure, there was no restriction as to his access of CDC-Secure. Id. at 14, 28-29. Despite his being transferred to another department, nothing in the record even suggests Gant had told Leomund that he was restricted as to what he could access on CDC- Secure. Id. at 14. In both of his positions, Leomund was required to access CDC-Secure. Id. Additionally, when Leomund received information about the Phyresis pathogen from Edgeworth after Leomund was fired, Leomund did not access CDC-Secure himself, for that would have constituted access “without authorization.” Instead, Edgeworth, a current employee of the CDC, serving in same capacity as Leomund had once served, had accessed CDC-Secure. Id. at 16. Therefore, under the plain meaning of the CFAA, Leomund never accessed CDC-Secure “without authorization.” In JBCHoldings NY, LLC v. Pakter, Pakter was charged with violating the Computer Fraud and Abuse Act (“CFAA”). JBCHoldings NY, LLC v. Pakter, 931 F. Supp. 2d 514, 519 (S.D.N.Y.2013). Pakter began working with JBCHoldings (“JBC”) after Pakter sold her company to JBC. Id. at 518. Pakter’s responsibility at JBC was to obtain business for JBC. Id. Pakter signed an agreement that she would not compete with JBC. Id. However, JBC discovered that Pakter had been diverting business to another company that she had established. Id. at 518- 19. Additionally, JBC discovered that Pakter had been receiving fees from JBC’s clients and diverting the funds to her other company. Id. at 518. Furthermore, JBC discovered that Pakter had been in contact with present and former JBC clients. Id. at 519. JBC alleged that Pakter accessed the client information without authorization when she used it to benefit her own business. Id. at 519.
  • 7. 22 The court held Pakter did not access the JBC’s information “without authorization” because such access to client information was part of her job. Id. at 525. In defining “without authorization,” the plain meaning of the statute is to be analyzed. Id. at 523. If the statute does not define a term, that term “must be given its ‘ordinary, contemporary, common meaning.’” Id. (quoting Perrin, 444 U.S. at 42). As a result, “the common meaning of ‘without authorization’ is ‘without any permission at all.’” Pakter, 931 F. Supp. 2d at 523 (quoting United States v. Aleynikov, 737 F. Supp. 2d 173, 191 (S.D.N.Y.2010)). Therefore, an employee acts “without authorization” under the CFAA when “he does so without permission to do so.” Pakter, 931 F. Supp. 2d at 523. The definition speaks only to access, not use. Id. B. The Broad Interpretation That “Without Authorization” Includes Violations of Employer Policies Is Contrary To Legislative Intent. In Int’l Airport Ctrs., LLC v. Citrin, Citrin was charged with violating the Computer and Fraud Abuse Act (“CFAA”). Int’l Airport Ctrs., LLC. v. Citrin, 440 F.3d 418, 418-19 (7th Cir. 2006). Citrin worked for International Airport Centers (“IAC”), for which he was assigned a laptop to be used for the recording of data he obtained while working with IAC. Id. at 419. Citrin resigned from IAC and entered into his own business, which was a violation of his employment contract with IAC. Id. Before returning his IAC laptop, Citrin deleted all of the data stored on it. Id. Such data included not only those he had collected while working for IAC, but also data that would have informed IAC of improper conduct that he had engaged in while working for IAC. Id. In order to do so, Citrin installed a secure-erase program that prevented the deleted files from being recovered by IAC. Id. IAC possessed no copies of the deleted data. Id. The court held Citrin had accessed IAC’s laptop without authorization because he breached a duty of loyalty to IAC. Id. at 420-21. Citrin’s installing of the secure-erase program was intended to cause damage to the IAC laptop’s files to the extent that IAC could not recover
  • 8. 23 them. Id. at 419. Citrin’s authority to use the laptop had terminated when he (1) engaged in misconduct on it, (2) quit IAC in violation of his employment contract, and (3) deleted files that would have incriminated himself as well as files that rightly belonged to IAC, which was a violation of his duty of loyalty to IAC. Id. Allowing “without authorization” to cover violations of employer restrictions “wraps the intent of the employees and use of the information into the CFAA despite the fact that the statute narrowly governs access, not use.” Jones, 957 F. Supp. 2d at 619. Requiring the mental intent of the employees be considered in the analysis would “collapse [the CFAA’s] independent requirements into a single inquiry . . . .” Brett Senior & Assocs., P.C. v. Fitzgerald, No. 06-1412, 2007 U.S. Dist. LEXIS 50833, at *15 (E.D. Pa. July. 13, 2007). As a result, the CFAA’s primary objective of punishing conduct that is “tantamount to trespass in a computer” would not longer be applicable. Clinton Plumbing and Heating of Trenton, Inc. v. Ciaccio, et. al., No. 09-2751, 2010 U.S. Dist. LEXIS 113215, at *18 (E.D. Pa. Oct. 22, 2010). II. LEOMUND DID NOT VIOLATE THE CFAA BECAUSE APPLYING AGENCY PRINCIPLES TO DETERMINE WHETHER AN EMPLOYEE “EXCEEDS AUTHORIZED ACCESS” FALLS OUTSIDE THE ORIGINAL CONGRESSIONAL INTENT The Computer Fraud and Abuse Act (“CFAA”) was enacted in order to “address the growing problem of computer hacking . . . .” United States v. Nosal, 676 F.3d 854, 858 (9th Cir.2012). The CFAA prohibits a number of crimes relating to computer use, including the prohibition of any individual who “exceeds authorized access . . . .” 18 U.S.C.A. §1030(a)(2). An individual “exceeds authorized access [when he gains access to] a computer with authorization to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.’” Nosal, 676 F.3d at 856. Since the plain language of the CFAA indicates that the only conduct that is clearly covered by the statute is the employer obtaining information that
  • 9. 24 is outside the bounds of his approved access, Leomund has not violated the “exceeds authorized access” provision of the CFAA. A. The Plain Meaning Of “Exceeds Authorized Access” Prohibits An Employee From Obtaining Information That Falls Outside The Bounds Of His Approved Access. In Nosal, Nosal was charged for violating the Computer Fraud and Abuse Act (“CFAA”). Nosal, 676 F.3d at 856. Nosal worked for Korn/Ferry, an executive search firm. Id. After leaving the company, Nosal had other Korn/Ferry employees to send him Korn/Ferry information stored in a confidential database on the firm’s computer. Id. The employees used their log-in credentials to download Korn/Ferry information. Id. The employees had authorization to access the confidential database, but Korn/Ferry prohibited employees from disclosing the confidential information. Id. It is alleged Nosal aided and abetted the employees in violating the CFAA, specifically, exceeding the employees’ authorized access to Korn/Ferry’s confidential database. Id. The court held that the phrase “exceeds authorized access” is limited only to violations regarding company restrictions on access to information, not to that information’s use. Id. at 864 (emphasis added). The plain language of the CFAA focuses on the unauthorized access of information and not its subsequent misuse. Id. at 863. In Dresser-Rand Co. v. Jones, Jones was charged with violating the Computer Fraud and Abuse Act. Dresser-Rand Co. v. Jones, 957 F. Supp.2d 610, 611 (E.D. Pa. 2013). Jones was a manager for Dresser-Rand. Id. Eventually, Jones resigned from Dresser-Rand. Id. However, prior to his resignation, Jones went to work with Global Power Specialist, Inc. Id. Jones downloaded Dresser-Rand documents to external hard drives and flash drives. Id. Thousands of Dresser-Rand documents were discovered to have been transferred from the external devices to
  • 10. 25 Global Power’s computers and accessed from Global Power’s computers. Id. at 612. Jones emailed some Dresser-Rand business information to Global Power through using Dresser-Rand computers. Id. An official of Dresser-Rand stated that he did not believe Jones accessed information other than what he had authorized access to do using their Dresser-Rand user name and password. Id. Dresser-Rand has a policy that prohibits employees from disclosing company- sensitive or privileged information. Id. Additionally, employees are prohibited from using Dresser-Rand’s systems in a way that “‘jeopardizes the integrity of the equipment, violates any Company policy, or is not in the best interest of the Company.’” Id. By using Dresser-Rand’s system, Jones consented to the policies. Id. at 613. Dresser-Rand is alleged to have exceeded his authorized excess to Dresser-Rand’s computers by downloading Dresser-Rand files to flash drives and external hard drives to benefit Global Power. Id. at 614. The court held Jones had not exceeded his authorized access to Dresser-Rand’s computers and, therefore, did not violate the CFAA. Id. at 619. Dresser-Rand’s policies only governed use, not access. Id. at 620. The CFAA governs only unauthorized computer access, not file access. Id. at 621. Jones accessed the downloaded documents from his Dresser-Rand computer and stored them on external storage devices, while employed at Dresser-Rand. Id. at 620. He had a user name and password to access the Dresser-Rand network as well as the laptops and external hard drives. Id. There were no limitations as to Jones’ ability to copy documents from the information he had authorized access to access. Id. Since he was authorized to access his work laptop and download files from it, he was not liable under the CFAA, despite the fact that he misused the information afterwards. Id. The Computer Fraud and Abuse Act (“CFAA”) prohibits accessing computers in a manner in excess of what he has been authorized and obtaining information or damaging computer data. Id. at 613 (citing 18 U.S.C. § 1030(a)).
  • 11. 26 Violating the CFAA exposes an individual to both civil and criminal liability. Jones, 957 F. Supp. 2d at 613. The CFAA’s original purpose was to provide a legal remedy to those victimized by computer hackers. Id. An individual has exceeded authorized access under the CFAA when he obtains or alters information to which he is not entitled. Id. at 614. However, the CFAA does not define “authorization,” which requires courts to “wrestle with the breadth of its meaning . . . .” Id. at 615. In Int'l Ass'n of Machinists & Aerospace Workers v. Werner-Matsuda, Werner-Matsuda was charged with violating the Computer Fraud and Abuse Act (“CFAA”). Int'l Ass'n of Machinists & Aerospace Workers v. Werner-Matsuda, 390 F. Supp. 2d 479, 484 (D. Md. 2005). Werner-Matsuda served as International Association of Machinists & Aerospace Workers’ (“IAM”) Secretary-Treasurer of a lodge IAM owned. Id. at 483. As an employee of IAM, Werner-Matsuda had access to IAM’s secured website which contained IAM’s confidential membership list. Id. Werner-Matsuda signed an agreement not to use confidential information located on the secure website that was contrary to IAM’s Constitution. Id. However, Werner- Matsuda had accessed the confidential information and used it to help another company seeking to challenge IAM in the union business. Id. IAM alleges Werner-Matsuda “exceeded her authorization” by violating the agreement she signed before working with IAM. Id. at 495. The court held that Werner-Matsuda did not exceed her access. Id. at 499. The court acknowledged that there is a distinction between mere use and authorization to access information and that the plain language of the statute necessitated their holding, because the CFAA does not prohibit unauthorized use of information. Id. at 499. The court pointed to legislative history, the fact that the CFAA is generally seen as a criminal statute and thus should be construed narrowly, and persuasive case law to come to its ultimate conclusion. Id. at 499.
  • 12. 27 Like the defendants in Nosal, Jones, and Werner-Matsuda, Leomund did not exceed his authorize access. There is no dispute that when Leomund accessed CDC-Secure himself, he was authorized to so as part of his job as the Assistant Content Director/Disease Projection Analyst in the Public Records Division of the CDC. J.A. 13-14. Additionally, even after Gant transferred Leomund to the department that analyzed the Alzheimer’s disease in American citizens, he still had authorization to access CDC-Secure. Id. at 14. Furthermore, after Leomund was terminated, he never gained access to CDC-Secure himself, but obtained the information from Edgeworth, a Topography Specialist of the CDC. Id. at 16. B. Applying A Broader Interpretation Of “Exceeds Authorized Access” Using Agency Principles Has Far-Reaching Effects Not Intended By Congress. In EF Cultural Travel Bv v. Explorica, Explorica is charged with violating the Computer Fraud and Abuse Act (“CFAA”). EF Cultural Travel Bv v. Explorica, 274 F.3d 577, 578 (1st Cir. 2001). Former employees of EF, one of the world’s largest private student travel organizations, joined Explorica, a company competing in a field of global tours for high school students. Id. at 579. Gormley, former Vice President of Information at EF, now Vice President of Explorica, believed that, by undercutting EF’s competitive prices on student tours, Explorica could achieve a substantial advantage over EF and other student tour companies. Id. In order to obtain the information of EF’s prices, Gormley retained Zefer, Explorica’s Internet consultant to create a internet computer program that would obtain all the necessary information from EF’s website. Id. The program focused solely on EF’s website using information that other programs like it would not have in its possession. Id. Using tour codes, the program easily obtained numerous amounts of pricing information from EF’s website and inserted them into a spreadsheet. Id. at 579-80. The spreadsheets were then sent to Explorica, which then used the information to
  • 13. 28 undercut EF’s prices. Id. at 580. Explorica then began printing brochures and competing in the tour market in which EF was participating. Id. The court found that Explorica and its employees had violated the “exceeded authorized access,” provision of the CFAA. Id. at 583. While employed at EF, Gormley had signed a confidentiality agreement. Id. at 582. The agreement prohibited Gormley from disclosing any confidential information of EF to a third party. Id. Additionally, the agreement prohibited Gormley from using EF’s confidential information for his own benefit or for the benefit of another person or business. Id. The agreement defined such information as any information that “the use or disclosure of which might reasonably be construed to be contrary to the interests of EF.” Id. Gormley had used some of the information he obtained as an employee at EF and communicated it to Zefer in order to create the program that obtained EF’s pricing information to compete with EF in the marketplace. Id. at 582-83. However, the court indicated that by holding Explorica and its employees had exceeded authorized use, they did not go into the “general arguments made about statutory meaning, including whether use of [the program] alone renders access unauthorized.” Id. at 581-82. In United States v. Rodriguez, Rodriguez was charged with violating the Computer Fraud and Abuse Act (“CFAA”). United States v. Rodriguez, 628 F.3d 1258, 1260 (11th Cir. 2010). Rodriguez worked as a representative for the Social Security Administration (“SSA”). Id. His responsibilities was to answer questions from the general public about social security benefits over the telephone. Id. As an representative, Rodriguez had access to the SSA’s databases that contained sensitive personal information. Id. The SSA established a policy that prohibited Rodriguez from obtaining SSA database information without a business reason. Id. Rodriguez had accessed the personal information of a number of individuals for nonbusiness reasons. Id. at
  • 14. 29 1260-1262. The SSA alleges Rodriguez had exceeded his authorized access to the database. Id. at 1260. The court held Rodriguez had exceeded his authorized access to the SSA’s database. Id. at 1263. Rodriguez conceded that he accessed information that was unauthorized. Id. The SSA had informed Rodriguez that he could not obtain personal information for nonbusiness reasons. Id. The court used the “plain language” of the CFAA to come to its decision. Id. at 1263-64. In United States v. John, John was charged with violating the Computer Fraud and Abuse Act (“CFAA”). United States v. John, 597 F.3d 263, 270 (5th Cir. 2010). John worked as an account manager at Citigroup. Id. at 269. As an employee of Citigroup, John had access to Citigroup’s internal computer system and customer account information. Id. John gave her half- brother multiple customer account information so that he and others could incur fraudulent charges. Id. at 269. The court held John had exceeded her authorized access. Id. Citigroup’s policies specifically prohibited the misuse of the company’s internal computer systems and confidential customer information. Id. at 272. Despite those policies, John accessed customer information and account information that she did not manage and used the highly sensitive and confidential information to perpetuate fraud on Citigroup and its customers. Id. Applying the the broad interpretations applied in Explorica, Rodriguez, and John in holding the respective defendants had violated the CFAA by violating employer restrictions will result in far-reaching effects that Congress did not intend. The broad interpretation “bases authorization on the whim of the employee at the given moment he or she uses a computer.” Jones, 957 F. Supp.2d at 618-19. Additionally, an employee’s liability under the CFAA would unlikely be altered merely because the employee’s mental state shifts from “‘loyal employee’” to
  • 15. 30 “‘disloyal competitor.’” LVRC Holdings, LLC. v. Brekka, 581 F.3d 1127, 1134 (9th Cir. 2009). Furthermore, it would “criminalize a broad range of day-to-day activity” and subject individuals to the “risk of arbitrary or discriminatory prosecution and conviction.” Nosal 676 F.3d at 862 (citing United States v. Kozminski, 487 U.S. 931, 949 (1988)). Its application could be applied to an employee who logs onto Facebook or checks sports scores, resulting in a termination of the agency relationship. WEC Carolina Energy Solutions, LLC. v. Miller, 687 F.3d 199, 206 (4th Cir. 2012). The CFAA fails to even mention agency or loyalty principles. Jones, 957 F. Supp. 2d at 619. The effect of the broad interpretation would be detrimental because courts would be required to decipher the moments in which a single employee’s interests weave in and out of alignment with the employer. The CFAA specifically differentiates authorization language between accessing a computer without authority or exceeding initially permitted access. Such broad interpretations would allow for removal of all distinctions between “without authorization” and “exceeds authorization.” Therefore, the broad interpretation should not be applied. III. THE AGGREGATE USE OF THE POLE CAMERA, LICENSE PLATE SCANNER, AND QUADROCOPTER DRONE WAS AN UNREASONABLE SEARCH UNDER THE FOURTH AMENDMENT BECAUSE THE INFORMATION OBTAINED AS A WHOLE VIOLATED LEOMUND’S REASONABLE EXPECTATION OF PRIVACY The Fourth Amendment of the United States Constitution prohibits the government from conducting unreasonable searches and seizures of individuals and their property. U.S. CONST. amend. IV. An unreasonable search occurs when the government violates an individual’s reasonable expectation of privacy. United States v. Jones, 132 S.Ct. 945, 951 (2012). An individual’s expectation of privacy is reasonable if society is prepared to recognize it as reasonable. Kyllo v. United States, 533 U.S. 27, 34 (2001); Katz v. United States, 389 U.S. 347,
  • 16. 31 361 (1967) (Harlan, J., concurring). When the government search involves surveillance through technology, and not physical trespass, such search is subject to the reasonable expectation of privacy analysis. Jones, 132 S. Ct. at 953 (2012). Therefore, because the extended surveillance of Leomund violated his reasonable expectation of privacy, the surveillances, as a whole, was an unreasonable search under the Fourth Amendment. A. The Advancement Of Modern Technology Requires The Adoption Of The Mosaic Approach To The Reasonable Expectation Of Privacy Analysis. In Jones, Jones was charged with conspiracy to distribute and possess with intent to distribute cocaine. Jones, 132 S.Ct. at 948. In order to obtain evidence against Jones, officers obtained a warrant to install a Global Positioning System (“GPS”) tracking device on his vehicle in the District of Columbia for 10 days. Id. However, the officers installed the device on the 11th day in Maryland. Id. The officers used the device to track the vehicle’s movements over the next 28 days. Id. The information obtained relayed more than 2,000 pages of data over a 4-week period. Id. The Court held there was a “search” under the Fourth Amendment because the installation of the GPS was a physical intrusion, and, therefore, the Katz analysis did not need to be applied. Id. at 949-50. However, the Court acknowledged that when a particular case involves the transmission of electronic signals without a physical trespass involved, that case is subject to the Katz analysis. Id. at 953. The Court left open the question of whether an extended surveillance of an individual solely through electronic means would constitute a violation of the Fourth Amendment. Id. at 953-54. It is to this question that Justices Alito and Sotomayor provide some guidance. Id. at 954-57 (Sotomayor, J., concurring); Id. at 963-64 (Alito, J., concurring). The Fourth Amendment must “cease to treat secrecy as a prerequisite for privacy.” Id. at 957. (Sotomayor, J., concurring). In today’s society, technology, including the GPS, reveals so
  • 17. 32 much information about an individual that, if aggregated, the government could determine an individual’s “familial, political, professional, religious, and sexual associations.” Id. at 955 (citing New York v. Weaver, 909 N.E.2d 1195, 1199 (N.Y. 2009)). However, while some people may accept the “increased convenience or security” that the technology may provide “at the expense of privacy,” others may come to understand that such a development is “inevitable[,]” and, therefore, accept the “tradeoff.” Jones, 132 S.Ct. at 962 (Alito, J., concurring). The emergence of new technology “will continue to shape the average person’s expectations about the privacy of his or her daily movements.” Id. at 963. The prolonged use of a GPS to monitor and investigate an individual “[for] most offenses impinges on expectations of privacy.” Id. at 964. Society would expect that the government would not and could not “secretly monitor and catalogue every single movement of an individual’s car for a very long period.” Id. The use of the GPS to track Jones’ every move for four weeks constitutes a “search” under the Fourth Amendment. Id. In Weaver, Weaver was convicted of burglarizing a K-Mart Store. Weaver, 909 N.E.2d at 1195. Police officers attached a global positioning system (GPS) to the bumper of Weaver’s van. Id. The GPS worked in conjunction with numerous satellites, from which received tracking data, to fix the location of Weaver’s van. Id. The GPS indicated the van’s speed and pinpointed its location within 30 feet. Id. The GPS readings indicated the speed and location of Weaver’s van approximately every minute while the van was in motion. Id. The readings were less often when the van was stationary. Id. In order for the police officers to download the GPS information, they would drive by Weaver’s van and press a button on a unit in their possession. Id. Upon the press of the button, the tracking history was transmitted to and saved by a computer in the officer’s vehicle. Id. The GPS was used for 65 days. Id. The GPS indicated that Weaver had been around
  • 18. 33 the store’s location around 7:26 traveling at a speed of six miles per hour. Id. The prosecution had the GPS readings admitted at trial against Weaver. Id. The court held that such a “dragnet use” of the GPS to track Weaver for 65 days was “not consistent with the values at the core of [the New York] Constitution’s prohibition against unreasonable searches.” Id. at 1203. Using the GPS to monitor an individual for extended periods of time reveals “with breathtaking quality and quantity . . . a highly detailed profile, not simply of where [the individual] go[es], but by easy inference, of [the individual’s] associations—political, religious, amicable and amorous, to name only a few—and of the pattern of [the individual’s] professional and avocational pursuits.” Id. at 1199-1200. The sorts of information revealed by the GPS include trips that are “indisputably private [in] nature of which takes little imagination to conjure . . . .” Id. at 1199. With such technology at the government’s disposal, “[t]he whole of a person’s progress through the world, into both public and private spatial spheres, can be charted and recorded over lengthy periods . . . .” Id. Now, prolonged tracking is “not merely possible[,] but entirely practicable . . . .” Id. The extended surveillance of Leomund is the manifestation of the concerns of concurrences in Jones, and the majority in Weaver. Officers were able to learn a great deal about Leomund that, when considered as a whole, reveals so much about his character that it infringes on his expectation of privacy. First, federal law enforcement officers set up a telephone pole camera outside of Leomund’s property. J.A. 15. For five (5) days, the officers received uninterrupted video of everything that occurred on Leomund’s property. Id. On two separate occasions, they were able to observe pizza delivered to Leomund’s residence. Id. On a single occasion, they observed Chinese food being delivered to Leomund’s residence. Id. On three separate occasions, they observed FedEx delivering packages to Leomund’s residence. Id.
  • 19. 34 During those five (5) days, based on these observations, they could tell Leomund had a taste for pizza and Chinese food. Additionally, they could tell that he had either purchased something or had something purchased for him because of the FedEx deliveries. Neither of these observations give any indication that Leomund had anything to do with the leaked information about the Phyresis pathogen. After the five-day video footage turned up unsuccessful, officers decided to use license plate scanners to indicate when Leomund had passed their vehicles. Id. For ten (10) days, officers received notifications anytime Leomund was traveling somewhere and where he was going at that particular time. Id. On two separate occasions, officers were notified that Leomund was at a local grocery store. Id. On a single occasion, officers were notified that Leomund was at a urologist’s office. Id. On two separate occasions, officers were notified that Leomund was at a psychiatrist’s office. Id. On a single occasion, officers were notified that Leomund was at a restaurant. Id. On three separate occasions, officers were notified that Leomund was at a gentlemen’s club in surrounding towns. Id. On three separate occasions, officers were notified that Leomund was driving on state roadways, one of which was near his residence. Id. During those ten (10) days, officers learned that Leomund needed groceries, had physical and mental issues, was hungry, and possibly needed sexual stimulation. Neither of these observations give any indication that Leomund had anything to do with the leaked information about the Phyresis pathogen. Instead, these observations revealed unquestionably private details of Leomund’s life. Third, Officer Armando was sent to Leomund’s residence to monitor the area and remain there to report anything unusual. Id. One (1) day later, Officer Armando observed a Black Sedan that was not registered to Leomund enter onto Leomund’s property. Id. at 16. Based on Officer Armando’s observations, federal agents dispatched an unmanned quadrocopter drone to Leomund’s property. Id. It was equipped with a digital camera that transmitted live video. Id.
  • 20. 35 It was used for twenty (20) minutes and surveyed the area at an altitude of 400 feet. Id. Using the cameras “zoom in” capabilities, the officers were able to see Leomund and Edgeworth using the CDC’s disease maps. Id. It was not until this point that the officers had something indicating Leomund has something to do with the leaks and that they decided to obtain a warrant. Id. In total, officers monitored Leomund for sixteen (16) days and twenty minutes (20) without a warrant. Allowing that amount of extended surveillance, only to have something relevant on day 16, is a clear violation of Leomund’s expectation of privacy that society would consider reasonable. B. The Supreme Court’s Previous Technology-Based Decisions Do Not Apply Because The Pole Camera, License Plate Scanners, and Quadrocopter Drone Revealed Far More Information Than The Technology At Issue In Those Cases In United States v. Knotts, Knotts, Armstrong, and Petschen were charged with conspiracy to manufacture controlled substances. United States v. Knotts, 460 U.S. 276, 277 (1983). 3M, Co., a chemical manufacturer had contacted narcotics investigators that Armstrong, a former employee had been stealing chemicals which could be used to manufacture illicit drugs. Id. at 278. Visual surveillance revealed Armstrong would steal the chemicals and purchase chemicals from Hawkins Chemical Co., another chemical manufacture. Id. Armstrong delivered those chemicals to Petschen. Id. With the consent of Hawkins Chemical, narcotics investigators installed a beeper inside a container of chloroform, a chemical used to manufacture the illicit drugs. Id. Hawkins Chemical agreed to sell that particular container to Armstrong. Id. When Armstrong purchased the container, he placed it in his vehicle and drove to another location. Id. The investigators followed Armstrong’s car by maintaining contact through the use of visual surveillance and a monitor receiving the signals from the beeper. Id. Armstrong delivered the container to Petschen at Petschen’s home. Id. Petschen took the container, placed it in his
  • 21. 36 vehicle, and drove to another location. Id. The investigators followed Petschen, who began taking evasive measures, causing investigators to lose visual surveillance. Id. However, the investigators were able to obtain a signal from the beeper, indicating its location at Knotts’ cabin. Id. Investigators obtained a search warrant for Knotts’ cabin, where they discovered drug laboratory equipment, drug chemicals, and the chloroform container. Id. at 279. The Court held the installation of the beeper was not a “search” under the Fourth Amendment. Id. at 285. The surveillance conducted by the investigators through the use of the beeper was principally the following of an automobile on public roads. Id. at 281. An individual has a “lesser expectation of privacy” when he uses an automobile on public roads. Id. (quoting Cardwell v. Lewis, 417 U.S. 583, 590 (1974) (plurality opinion)). By traveling on public roads, Petschen’s direction of travel and destination were “conveyed to anyone who wanted to look . . . .” Knotts, 460 U.S. at 281-82. Additionally, although Knotts had an expectation of privacy in activity that occurred in his cabin, he had no reasonable expectation of privacy “to the visual observation of Petschen’s automobile arriving on his premises after leaving a public highway, nor to movements of objects such as the drum of chloroform outside the cabin in the ‘open fields.’” Id. at 282 (quoting Hester v. United States, 265 U.S. 57 (1924)). Visual surveillance from public areas would have revealed all of the information that the beeper revealed. Knotts, 460 U.S. at 282. However, the court limited their holding to the brief surveillance that occurred in the facts before it. Knotts argued that the Court’s holding would permit longer surveillance without judicial approval. Id. at 283-84. rejecting the argument, the Court reasoned that “the ‘reality hardly suggests abuse,’ . . . [for] if such dragnet-type law enforcement practices as [Knotts] envisions should eventually occur, there will be time enough then to determine whether
  • 22. 37 different constitutional principles may be applicable. Id. at 283-84 (quoting Zurcher v. Standford Daily, 436 U.S. 547, 566 (1978)). In California v. Ciraolo, Ciraolo was charged with the cultivation of marijuana. California v. Ciraolo, 476 U.S. 207, 210 (1986). Police officers received an anonymous tip that Ciraolo was growing marijuana in his backyard. Id. at 209. When the officers went to investigate, they were unable to observe what was going on in Ciraolo’s backyard from ground level because there was a 6-foot outer fence and a 10-foot inner fence completely enclosing the yard. Id. Officers obtained a private plane and flew over Ciraolo’s house from 1,000 feet in the area. Id. The officers were able to identify the marijuana plants from the plane and took a picture of the area with a standard 35mm camera. Id. Based on the tip and the observations, officers obtained a search warrant and seized the marijuana. Id. at 209-10. The Court held Ciraolo had no reasonable expectation of privacy in his yard when the officers observed the marijuana from navigable airspace. Id. at 214-15. Although Ciraolo’s yard was a party of the curtilage of his home, that itself does not bar all police observations. Id. at 213. Additionally, Ciraolo’s attempts to prevent his activity from being seen does not prohibit police observations from areas where they “a right to be and which renders the activities clearly visible.” Id. (citing Knotts, 460 U.S. at 282). The Fourth Amendment does not protect the activities an individual knows has been exposed to the public. Ciraolo, 476 U.S. at 213 (quoting Katz, 389 U.S. at 347). In Florida v. Riley, Riley was charged with possession of marijuana. Florida v. Riley, 488 U.S. 445, 449 (1989). The Sheriff’s office received an anonymous tip that Riley was growing marijuana in a greenhouse on his property. Id. at 448. When an officer sought to investigate Riley’s property, he was unable to see the contents of Riley’s greenhouse from the road because
  • 23. 38 of the surrounding trees, shrubs, and Riley’s motor home. Id. Additionally, Riley’s greenhouse was covered by roofing panels. Id. The officer obtained a helicopter and flew above Riley’s property at the height of 400 feet. Id. While flying in the air, the officer noticed the greenhouse had two roof panels, approximately 10 percent of the roofing area, missing. Id. Using his naked eye, the officer could see through the opening of the roof and identify what he believed to be marijuana growing inside of it. Id. The officer obtained a warrant based on his observations and searched the greenhouse, which indeed contained marijuana. Id. at 449. Using the rationale of California v. Ciraolo, the Court held that Riley had no expectation of privacy when the officer observed the marijuana from navigable airspace. Id. at 450-51. The marijuana was viewable from the air as a result of the missing roof panels. Id. at 450. Since private and commercial flights are routine in the United States, and that such flights were not unheard of where Riley resided, he had no expectation of privacy when anyone from the public could observe from the navigable airspace the marijuana he was growing. Id. at 450-51. The helicopter was flying within the bounds of the law and navigable airspace. Id. at 451. Additionally, no intimate details of the home or curtilage had been observed by the officer. Id. at 452. The “dragnet-type” of surveillance the Court noted in Knotts has occurred in Leomund’s case. Unlike the surveillances in Knotts, Ciraolo, and Riley, the surveillance of Leomund by federal officers lasted extended far beyond a single destination and beyond a single day. Officers monitored Leomund for sixteen (16) days, observing Leomund going to several different locations, all of which did not implicate he had anything to do with leaking the information about the Phyresis pathogen. Additionally, the surveillance in Knotts did not reveal private details of the defendant’s life. The sixteen (16) day surveillance revealed a number of private details of
  • 24. 39 Leomund’s life, from visiting a urologist and psychiatrist’s office, to attending a gentlemen’s club. Id. at 15. It was not until day sixteen that federal officers had specific evidence that Leomund had anything to do with the leak of the Phyresis pathogen. Prior to that time, Leomund’s private affairs became known to the federal officers, all of which were irrelevant to the access of CDC-Secure. CONCLUSION Therefore, because Leomund did not access CDC-Secure “without authorization,” and did not “exceed [his] authorized access” under the plain meaning of the term “authorization,” Leomund did not violate the CFAA. Additionally, because the aggregate use of the pole camera, license plate scanner, and quadrocopter drone violated Leomund’s reasonable expectation of privacy, an unreasonable search has occurred, in violation of the Fourth Amendment. We respectfully request that this Court reverse the the holding of the United States Court of Appeals for the Fourteenth Circuit.