The Computer Fraud and Abuse Act (CFAA): A Complete Guide for Individuals and Businesses

Table of Contents#

1. What Is the Computer Fraud and Abuse Act (CFAA)?
2. Origins and Evolution of the CFAA
   • 1986: The Initial Enactment
   • Key Amendments Over Time
3. Key Provisions of the CFAA (18 U.S.C. § 1030)
   • Unauthorized Access to Obtain Information
   • Access Causing Damage to Computers
   • Trafficking in Passwords or Access Devices
   • Denial-of-Service (DoS) Attacks
4. Who Does the CFAA Apply To?
5. Common CFAA Violations to Avoid
6. Penalties for CFAA Violations
   • Misdemeanor vs. Felony Charges
   • Civil Penalties
7. Criticisms and Controversies Surrounding the CFAA
   • Overbreadth and Ambiguity
   • The Aaron Swartz Case
   • Post-Van Buren Clarifications
8. Recent Landmark CFAA Cases
   • United States v. Van Buren (2021)
   • United States v. Nosal (2016)
9. How to Stay Compliant with the CFAA
   • For Individuals
   • For Businesses
10. Conclusion
11. References

---

1. What Is the Computer Fraud and Abuse Act (CFAA)?#

The Computer Fraud and Abuse Act (CFAA) is a federal law in the United States (codified at 18 U.S.C. § 1030) that criminalizes unauthorized access to computers and computer systems. Its core purpose is to protect sensitive government, corporate, and personal data from theft, damage, and misuse. Unlike state-level cybercrime laws, the CFAA applies to interstate and international cyber activities, making it the primary tool for federal prosecutors to pursue cybercriminals.

---

2. Origins and Evolution of the CFAA#

1986: The Initial Enactment#

The CFAA was passed in response to rising concerns about early computer hacking incidents, including the 1983 case where a teen hacked into the Pentagon’s ARPANET (the precursor to the internet). The original law focused narrowly on unauthorized access to federal government computers, with penalties limited to misdemeanors for first-time offenders.

Key Amendments Over Time#

• 1996 (National Information Infrastructure Protection Act): Expanded the CFAA to cover commercial computers and added felony penalties for offenses involving financial or medical data. It also criminalized trafficking in passwords and access devices.
• 2001 (USA PATRIOT Act): Broadened the law to include terrorism-related cybercrimes, allowed federal authorities to wiretap cyber offenders, and increased penalties for attacks on critical infrastructure (e.g., power grids, hospitals).
• 2015 (CFAA Improvements Act): Addressed some criticisms of overreach by reducing penalties for minor, non-commercial offenses and limiting prosecutions for individuals who access computers with intent to investigate security flaws (ethical hackers, with caveats).

---

3. Key Provisions of the CFAA (18 U.S.C. § 1030)#

The CFAA outlines several specific offenses, each with distinct elements:

Unauthorized Access to Obtain Information#

This provision criminalizes accessing a computer without permission (or exceeding authorized access) to obtain:

• Government information (e.g., classified data)
• Financial records (e.g., bank account details)
• Medical records
• Trade secrets or proprietary corporate data

Example: A former employee hacks into their old company’s server to steal customer credit card numbers.

Access Causing Damage to Computers#

This applies to individuals who access a computer without permission and intentionally cause damage, including:

• Deleting or modifying data
• Spreading malware (e.g., ransomware, viruses)
• Disrupting system operations (e.g., crashing a website)

Damage is defined as losses exceeding $5,000 within a one-year period, or harm to critical infrastructure.

Trafficking in Passwords or Access Devices#

This prohibits selling, distributing, or transferring passwords, access codes, or other tools that allow unauthorized access to computers. It also covers using such devices to gain access.

Example: A hacker sells a list of stolen Netflix login credentials on the dark web.

Denial-of-Service (DoS) Attacks#

The CFAA criminalizes launching DoS or distributed DoS (DDoS) attacks that disrupt or disable computer systems. These attacks overwhelm a system with traffic, making it unavailable to legitimate users.

---

4. Who Does the CFAA Apply To?#

The CFAA has broad jurisdiction:

• Individuals: Anyone who engages in unauthorized computer access within the U.S. or whose actions affect U.S. interests (e.g., hacking a U.S. company from abroad).
• Businesses: Corporations can be held liable if their employees or agents violate the CFAA, or if the company fails to prevent unauthorized access.
• Government Entities: Federal, state, and local agencies are protected under the CFAA, and employees who misuse government computers can face prosecution.
• Foreign Actors: The CFAA applies to non-U.S. citizens if their cyber activities cause harm to U.S. computers or data.

---

5. Common CFAA Violations to Avoid#

While the CFAA covers serious cybercrimes, it also applies to seemingly minor actions that many people may not realize are illegal:

• Using someone else’s login credentials without explicit permission (e.g., sharing a streaming service password, though recent court rulings have narrowed this).
• Accessing a work computer to view confidential files outside your job responsibilities (pre-2021, this was more ambiguous; see Section 8).
• Spreading malware that damages a friend’s or colleague’s computer.
• Scraping data from a website in violation of its terms of service (though this is still debated in courts).

---

6. Penalties for CFAA Violations#

Penalties vary based on the severity of the offense:

Misdemeanor vs. Felony Charges#

• Misdemeanor: First-time offenses involving non-government computers and no significant damage can result in up to 1 year in prison and a $100,000 fine.
• Felony: Offenses involving government computers, financial/medical data, or damage exceeding $5,000 carry up to 5 years in prison and a$250,000 fine for first-time offenders. Repeat offenders or those causing severe harm (e.g., disrupting critical infrastructure) can face up to 20 years in prison.

Civil Penalties#

Victims of CFAA violations can file civil lawsuits to recover damages, including:

• Lost profits
• Costs of repairing damaged systems
• Legal fees
• Compensation for identity theft or data breach-related harm

---

7. Criticisms and Controversies Surrounding the CFAA#

Despite its purpose, the CFAA has faced widespread criticism:

Overbreadth and Ambiguity#

Critics argue the law is overly broad, particularly the phrase “exceeding authorized access.” For years, this was interpreted to include violating a website’s terms of service or misusing information you’re allowed to access, leading to prosecution for minor actions.

The Aaron Swartz Case#

In 2011, activist Aaron Swartz downloaded millions of academic articles from JSTOR using his MIT campus access. Though he had permission to access JSTOR, he exceeded the platform’s download limits. He was charged with 13 CFAA counts, facing up to 35 years in prison. Swartz committed suicide in 2013, sparking national debates about the CFAA’s harshness and overreach.

Post-Van Buren Clarifications#

The 2021 Supreme Court case United States v. Van Buren narrowed the “exceeding authorized access” provision, ruling it only applies to accessing areas of a computer you’re explicitly prohibited from entering—not misusing information you’re allowed to access. This decision reduced the law’s overreach, though ambiguities remain.

---

8. Recent Landmark CFAA Cases#

United States v. Van Buren (2021)#

A police officer used his law enforcement database access to look up a license plate for a friend in exchange for money. The Supreme Court ruled this did not violate the CFAA, as the officer was authorized to access the database—he just misused the information. This decision clarified that “exceeding authorized access” refers to accessing restricted parts of a system, not misusing data you’re permitted to view.

United States v. Nosal (2016)#

Former employees of a recruiting firm downloaded client lists before leaving to start a competing business. The Ninth Circuit ruled that violating a company’s computer use policy does not constitute a CFAA violation, as the employees were authorized to access the lists. This case further limited the law’s application to explicit unauthorized access.

---

9. How to Stay Compliant with the CFAA#

For Individuals#

• Never use someone else’s login credentials without their explicit, written permission.
• Avoid accessing computers, networks, or files you’re not authorized to use.
• Be cautious about downloading files or clicking links from unknown sources to prevent accidentally spreading malware.
• Review website terms of service, but note that not all TOS violations are CFAA offenses post-Van Buren.

For Businesses#

• Implement role-based access controls to ensure employees only access data necessary for their jobs.
• Train employees on acceptable use policies and the consequences of CFAA violations.
• Regularly audit access logs to detect unauthorized activity.
• Develop a cyber incident response plan to mitigate damage if a breach occurs.
• Consult with legal counsel to ensure your policies align with current CFAA interpretations.

---

10. Conclusion#

The Computer Fraud and Abuse Act is a critical tool for combating cybercrime, but its history of overreach and ambiguity has sparked important debates about balancing security and individual rights. Recent Supreme Court rulings have narrowed its scope, making it clearer what constitutes a violation. Whether you’re an individual or a business, understanding the CFAA’s provisions and staying compliant is essential to protecting your digital assets and avoiding legal consequences.

---

References#

1. Cornell Law School. (n.d.). 18 U.S.C. § 1030 - Fraud and related activity in connection with computers. Retrieved from https://www.law.cornell.edu/uscode/text/18/1030
2. U.S. Department of Justice. (2023). Computer Fraud and Abuse Act (CFAA). Retrieved from https://www.justice.gov/criminal-fraud/computer-fraud-and-abuse-act
3. Supreme Court of the United States. (2021). United States v. Van Buren, 593 U.S. ___ (2021). Retrieved from https://www.supremecourt.gov/opinions/20pdf/19-783_j4el.pdf
4. Electronic Frontier Foundation. (n.d.). Aaron Swartz & the CFAA. Retrieved from https://www.eff.org/cases/aaron-swartz