Computer Fraud and Abuse Act 1986

The Computer Fraud and Abuse Act (CFAA), enacted on 26 October 1986 as Title 18, U.S.C. § 1030, is the United States’ primary federal statute criminalising unauthorised access to computer systems. Drafted in the wake of the 1983 “Morris worm” incident, the law uniquely blends traditional concepts of trespass with the nascent digital environment, giving prosecutors a tool to pursue a wide spectrum of cyber‑offences—from simple password cracking to large‑scale data exfiltration. Its breadth and the severity of its penalties—up to five years’ imprisonment for a first‑time violation and up to ten years for offenses involving national security or financial institutions—have made the CFAA a cornerstone of American cyber‑law enforcement and a frequent subject of scholarly debate. ## Origins / Historical Background The CFAA originated as an amendment to the 1979 Computer Fraud and Abuse Act, itself part of the broader Electronic Communications Privacy Act of 1986. Lawmakers responded to the rapid diffusion of personal computers and the 1988 “Morris worm” that crippled roughly one‑third of the nation’s ARPANET‑connected machines, prompting Congress to codify “unauthorised access” as a federal crime. The original text defined a “protected computer” as any computer used in or affecting interstate or foreign commerce, a definition later expanded in the 1994 and 1996 amendments to include any computer used by the federal government and, eventually, virtually every device connected to the Internet. ## Key Provisions Section 1030(a)(2) criminalises intentional access without authorization—or exceeding authorised access—to obtain information from any protected computer. Subsection (a)(4) targets fraud and related activity in connection with a protected computer, imposing penalties of up to ten years when the offense involves a financial institution or the United States government. The act also creates civil liability under 18 U.S.C. § 1030(g), allowing victims to sue for actual damages and injunctive relief. Penalties are calibrated by the nature of the target: violations involving a “protected computer” used in interstate commerce carry a maximum fine of $250,000 per count, while those affecting national security can trigger fines of up to $1 million. ## Enforcement Mechanism The Department of Justice, primarily through the Computer Crime and Intellectual Property Section (CCIPS), coordinates prosecutions, while the Federal Bureau of Investigation and the U.S. Secret Service conduct investigations and digital forensics. A typical case begins with a subpoena to the target’s ISP for IP logs, followed by a forensic image of the suspect’s device to establish the “without authorization” element. Prosecutors must demonstrate that the defendant knowingly accessed a protected computer and either obtained information, caused damage exceeding $5,000, or transmitted a program that caused damage, as stipulated in 18 U.S.C. § 1030(a)(5). Convictions often hinge on the “exceeds authorised access” clause, a point of contention that has generated extensive appellate litigation. ## Notable Cases and Legal Evolution The 1995 conviction of Kevin Mitnick, who was sentenced to five years for hacking into corporate networks, marked the CFAA’s first high‑profile application and cemented its reputation as a deterrent. In 2009, United States v. Lori Drew invoked the act to pursue a civil claim against a teenager who created a fake MySpace profile, illustrating the statute’s reach into online harassment. The 2013 prosecution of Aaron Swartz for mass‑downloading academic articles sparked a public outcry over perceived overreach, leading to the 2015 “Aaron’s Law” proposal that sought to narrow the “exceeds authorised access” language. The Supreme Court’s 2021 decision in Van Buren v. United States clarified that the CFAA does not punish a user for violating a website’s terms of service, narrowing the scope of “exceeds authorised access” and prompting renewed calls for reform. ## Current Status, Controversies, and Reform Efforts As of 2024, the Department of Justice reports roughly 1,200 CFAA prosecutions annually, with a steady increase in cases involving ransomware and supply‑chain attacks on critical infrastructure. Critics—including the Electronic Frontier Foundation and several congressional members—argue that the act’s vague language enables selective prosecution and stifles legitimate security research. Legislative initiatives such as the “SAFE Computing Act” (introduced in 2023) propose to replace the “exceeds authorised access” test with a clearer “unauthorised access” standard and to establish safe‑harbor provisions for vulnerability disclosure. Meanwhile, the act remains a pivotal tool for agencies combating state‑sponsored cyber‑espionage, as evidenced by the 2022 indictment