Computer Fraud and Abuse Act

Computer Fraud and Abuse Act
U.S. Government · Public domain · source
Name	Computer Fraud and Abuse Act
Enacted by	United States Congress
Enacted by body	United States House of Representatives and United States Senate
Enacted	1986
Effective	1986
Status	amended

Computer Fraud and Abuse Act The Computer Fraud and Abuse Act (CFAA) is a United States federal statute enacted to address unauthorized access to computer systems and related criminal activity. Drafted amid concerns about rising computer crime incidents and high-profile breaches, the statute has been central to prosecutions, debates over digital civil liberties, and legislative reform efforts involving multiple actors and institutions. The CFAA intersects with judicial decisions from the United States Supreme Court, enforcement by the Department of Justice, and policy work by congressional committees and civil society organizations.

History and legislative background

The CFAA originated in legislative responses to incidents like breaches involving entities such as AT&T, NASA, Department of Defense, and private sector firms during the early 1980s, and was shaped by hearings before the United States Senate Committee on the Judiciary and the United States House Committee on Energy and Commerce. Key advocates included members of the United States Congress and counsel from the Federal Bureau of Investigation and Secret Service, while opposition and commentary came from legal scholars at institutions like Harvard University, Yale University, Stanford University, and advocacy groups such as the Electronic Frontier Foundation and American Civil Liberties Union. The original 1986 text amended statutes including the Bank Fraud Act framework and responded to emerging concerns highlighted by cases involving actors linked to networks like ARPANET and incidents publicized by outlets such as The New York Times and The Washington Post.

Key provisions and definitions

The CFAA defines offenses related to unauthorized access or exceeding authorized access to protected computers, with statutory language interpreted in decisions by the United States Court of Appeals for the Second Circuit, United States Court of Appeals for the Ninth Circuit, and ultimately shaped by rulings from the United States Supreme Court. The statute identifies protected computers used in or affecting interstate commerce and specific targets including systems owned by entities such as financial institutions, telecommunications companies, federal agencies like Internal Revenue Service and Social Security Administration, and critical infrastructure sectors overseen by agencies like the Department of Homeland Security. Penalties vary by severity, incorporating provisions from statutes addressing wire fraud, identity theft, and espionage-adjacent concerns, and involve enforcement by the United States Attorney General and investigative support from agencies including the Secret Service and Central Intelligence Agency when national security issues arise.

Notable amendments and legislative changes

Since 1986, Congress enacted amendments through measures influenced by incidents and reports from bodies like the National Institute of Standards and Technology, the 1994 Communications Decency Act legislative context, and later bills shepherded by committees such as the Senate Judiciary Committee and the House Judiciary Committee. Significant changes occurred with the 1994 amendments, the 1996 amendments tied to Computer Misuse concerns, and post-9/11 expansions during debates involving the USA PATRIOT Act and homeland security legislation. Legislative proposals from senators and representatives including Patrick Leahy, Orrin Hatch, and Howard Coble have periodically sought to clarify mens rea, civil liability, and research exceptions, with lobbying from organizations like Microsoft, Google, Apple Inc., and trade groups including the Computer & Communications Industry Association.

Major prosecutions and case law

The CFAA has been the basis of major prosecutions and influential appellate decisions involving defendants tied to incidents publicized by outlets like Wired and adjudicated in courts such as the United States District Court for the Eastern District of Virginia and the United States Court of Appeals for the Federal Circuit. Landmark cases shaping CFAA interpretation include appellate decisions examined by the United States Supreme Court and lower courts that referenced actors and entities such as Aaron Swartz-related litigation, prosecutions involving insiders at firms like Facebook and Uber, and corporate disputes invoking the statute between companies like Oracle and Google. Case law from circuits including the Second Circuit, the Ninth Circuit, and the D.C. Circuit have addressed issues of authorized access, terms-of-service breaches, and standing for civil plaintiffs such as corporations like Sony and Bank of America.

Criticisms and controversies

Criticism of the CFAA has been raised by legal academics from institutions including Columbia Law School, University of Chicago Law School, and NYU School of Law, along with advocacy from the Electronic Frontier Foundation, the American Civil Liberties Union, and researchers affiliated with MIT. Controversies focus on alleged overbreadth, vagueness, potential chilling effects on security research conducted by academics at Carnegie Mellon University or independent researchers linked to conferences like DEF CON and Black Hat, and prosecutorial discretion illustrated in cases publicized by outlets such as The Guardian and ProPublica. Legislative reform campaigns have involved coalitions including Fight for the Future and proposals debated in Congress that drew attention from technology companies like Amazon (company) and Cisco Systems.

Impact on cybersecurity and research

The CFAA affects vulnerability disclosure practices promoted by organizations like the National Vulnerability Database, standards bodies such as Internet Engineering Task Force, and corporate bug-bounty programs run by firms including Google, Microsoft, and Facebook. Security researchers at universities like University of Cambridge and private labs such as Kaspersky Lab and Symantec have cited the statute when weighing legal risks for reverse engineering, penetration testing, and coordinated disclosure to vendors like Cisco Systems and Intel. Debates over safe harbor provisions and clarity for academic freedom have involved policy input from National Science Foundation and non-profits like Open Technology Institute.

International influence and enforcement cooperation

The CFAA's model has influenced foreign statutes and cooperative law-enforcement frameworks involving partners such as Europol, Interpol, and bilateral instruments between the United States Department of Justice and counterparts like the Crown Prosecution Service in the United Kingdom and agencies in the European Union. Mutual legal assistance treaties and joint investigations have implicated multinational corporations such as Microsoft, Apple Inc., and Google and informed transnational cybercrime policy dialogues at forums like the G7 and United Nations General Assembly cybersecurity discussions. Cross-border prosecutions highlight coordination with national authorities including Federal Bureau of Investigation liaison offices, the Royal Canadian Mounted Police, and prosecutors in jurisdictions like Germany and Japan.

Category:United States federal criminal law