Statement on Supreme Court Decision Removing Hurdles to Online Civil Rights Testing and Research

WASHINGTON — The Supreme Court issued a decision today in Van Buren v. United States, narrowly interpreting the Computer Fraud and Abuse Act (CFAA) in a manner protecting civil rights researchers and journalists who test for discrimination online. The court’s decision makes clear that violations of website terms of service alone are not enough to create liability under the CFAA.

The ACLU has long challenged the interpretation of the CFAA that would create criminal and civil liability for researchers and journalists who violate website terms of service while undertaking civil rights testing and research online. The ACLU filed its challenge to the constitutionality of the CFAA, Sandvig v. Barr, in 2016, on behalf of academics and journalists seeking to test websites for discrimination among users. In 2020, the district court held that the CFAA should not be read to prohibit violations of website terms of service alone.

In today’s decision, the Supreme Court cited the ACLU’s amicus brief on behalf of civil rights testers, as well as government testimony elicited in the Sandvig district court win.

“This is an important victory for civil liberties and civil rights enforcement in the digital age,” said Esha Bhandari, deputy director of the ACLU’s Speech, Privacy, and Technology Project. “The Supreme Court’s decision will allow researchers and journalists to use common investigative techniques online without fear of CFAA liability. It clears away a major barrier to online anti-discrimination testing and research, which is necessary to hold powerful companies and platforms accountable.”

The plaintiffs in the Sandvig case are academic researchers, computer scientists, and journalists who wish to investigate companies’ online practices through standard academic and journalistic techniques, but are limited by the terms of service of target websites.

“I am elated that the Supreme Court made clear today that violations of websites’ terms of service alone do not constitute violations of the Computer Fraud and Abuse Act,” said Alan Mislove, one of the plaintiffs in Sandvig, and a professor of computer science at Northeastern University. “This decision removes a significant cloud of uncertainty and legal risk for researchers who perform online civil rights testing.”

Christian Sandvig, director of the Center for Ethics, Society and Computing and professor of information at the University of Michigan, said, “This is a major milestone for researchers working to stop racial and other forms of discrimination online. The work that these journalists and academics do every day has been transformed by this decision.”

More information on the Sandvig case is available online here:
https://www.aclu.org/cases/sandvig-v-barr-challenge-cfaa-prohibition-uncovering-racial-discrimination-online