Computer Fraud & Abuse Act

The Computer Fraud and Abuse Act (CFAA) is a foundational piece of U.S. legislation that addresses computer crimes and the unauthorized use of computers and networks. Enacted in the 1980s as an amendment to existing computer fraud law, the CFAA was primarily designed to combat hacking. However, over the years, it has been amended to address the evolving landscape of cybercrimes and the complexities introduced by the digital age.

What Does the Computer Fraud and Abuse Act Cover?

The CFAA covers a wide range of unauthorized computer activities. Broadly, it criminalizes accessing a computer without authorization or exceeding authorized access and thereby obtaining information from any protected computer.

Unauthorized Access vs. Exceeding Authorized Access under the CFAA

The CFAA targets both those who access computers without any authorization and those who go beyond the boundaries of their granted access. Understanding the distinctions between these categories is pivotal in comprehending the scope and reach of the CFAA.

Accessing a Computer Without Authorization

This involves gaining entry into a computer or computer system without any permission whatsoever. It’s the most straightforward form of violation under the CFAA. Typically, it is what comes to mind when thinking of traditional hacking. Here are some facets of unauthorized access:

• Hacking: This is the most common representation of unauthorized access, where a person uses various methods or tools to gain entry into a computer or network they have no rights.
• Bypassing Security: Circumventing security protocols, like passwords or firewalls, to access a computer system falls under this category.
• Use of Malware or Viruses: Introducing malicious software to compromise a system and gain unauthorized entry is another method of violating the CFAA.

Exceeding Authorized Access

This category is more nuanced. It involves situations where an individual has permission to access a computer but goes beyond the limits of that permission. Examples of exceeding authorized access include:

• Employee Misuse: An employee, while having legitimate access to a company computer, might access data or areas of the network that are off-limits to them. For instance, an employee in the sales department who is accessing confidential HR records.
• Misuse of Login Credentials: If a person has access credentials to certain parts of a system but uses them to gain entry into unauthorized areas, they’re exceeding their authorized access. This might be done by exploiting vulnerabilities in the system.
• Access for Malicious Intent: Even if an individual has legitimate access to a computer system, using that access to introduce malware, steal data, or cause harm can be considered as exceeding authorized access under the CFAA.

The distinctions between unauthorized access and exceeding authorized access are critical. While both are illegal under the CFAA, they reflect different types of infractions: one where a person has no right to access at all and another where the person abuses a given privilege. Both can result in severe legal repercussions, and understanding these categories is vital for anyone navigating the digital realm, both as users and administrators.

The Act has been used to prosecute not only traditional hackers but also employees who access company information in violation of company policy. In recent years, its overlap with mail and wire fraud statutes has allowed for a more expansive prosecution of cybercrimes, further fortifying cyberspace law.

Prosecution of Employees Under the CFAA

The Computer Fraud and Abuse Act has evolved to address a wide range of unauthorized computer access activities, including those committed by inside actors, such as employees. The interpretation of “exceeding authorized access” has paved the way for the Act’s application to employees who breach company policy:

• Breach of Acceptable Use Policy: Some companies have specific computer use policies outlining what employees can and cannot do on company devices or networks. An employee downloading unauthorized software, browsing restricted websites, or accessing data beyond their work requirements could potentially be prosecuted under the CFAA.
• Whistleblowers and Data Theft: There have been instances where employees intending to expose alleged wrongdoing within their company have accessed and disseminated sensitive company information. Though their intentions might be rooted in whistleblower motivations, their actions could be prosecuted if they accessed data outside their authorization.
• Employee Departures: Employees leaving a firm, especially on bad terms, might attempt to access company data, customer lists, or proprietary algorithms. Such unauthorized access post-departure can fall under the purview of the CFAA.

Overlap with Mail and Wire Fraud Statutes

The CFAA’s intersection with mail and wire fraud statutes has expanded the toolkit available to prosecutors handling cybercrimes:

• Multi-faceted Prosecution: When cybercrimes involve electronic communications that defraud victims of money, property, or anything of value, prosecutors can invoke both the CFAA and wire fraud statutes. This enables them to charge the perpetrators for unauthorized access and for the fraudulent scheme they executed using that access.
• Expanding the Reach: By coupling the CFAA with mail and wire fraud statutes, prosecutors can target not only the act of unauthorized access but also subsequent illicit activities. For instance, if a hacker accesses a company’s database without authorization and then uses stolen data for a phishing scheme via email, both the CFAA and mail fraud statutes could be applied.
• Stiffer Penalties: The combined weight of these statutes often results in heavier penalties, acting as a stronger deterrent against cybercrimes. While the CFAA alone can result in substantial penalties, adding mail or wire fraud charges can significantly enhance potential prison sentences and fines.

The flexibility and breadth of the CFAA, combined with its synergy with other laws like mail and wire fraud statutes, demonstrate the evolving landscape of cyberspace law. As digital malfeasance grows more intricate, so does the legal apparatus to counteract it.

What Is a Protected Computer Under the CFAA?

Under the CFAA, a “protected computer” is one used by or for a financial institution or the U.S. government or one that is used in or affects interstate or foreign commerce or communication. Given today’s interconnected world, this definition encompasses almost any computer connected to the internet, thereby providing the CFAA with a vast jurisdictional reach.

What Are Common Examples of Computer Crime That the CFAA Covers?

Computer crimes under the CFAA are diverse. They include:

• Unauthorized access to government computers or data;
• Distributing malicious software like viruses or worms that damage or disable computer systems;
• Trafficking in passwords to access a computer without proper authorization;
• Transmitting spam emails or phishing schemes, particularly when they intersect with mail and wire fraud components;
• Unauthorized access to obtain sensitive or classified information, often for personal gain or to sell on the dark web.

What Are the Penalties for Violating the CFAA?

The criminal penalties for violating the CFAA depend on the nature and severity of the offense, as well as the prior criminal history of the offender. The CFAA defines seven categories of prohibited conduct, each with its own penalty scheme. Here is a summary of the possible sentences for each category:

• Obtaining national security information through unauthorized computer access and sharing or retaining it: Up to 10 years in prison for a first offense and up to 20 years for a subsequent offense.
• Obtaining certain types of information through unauthorized computer access: Up to one year in prison for a first offense and up to five years if the offense was committed for commercial or private gain, in furtherance of another crime, or if the value of the information exceeded $5,000.
• Trespassing in a government computer: Up to one year in prison for a first offense and up to 10 years for a subsequent offense.
• Engaging in computer-based frauds through unauthorized computer access: Up to five years in prison for a first offense and up to 10 years for a subsequent offense.
• Knowingly causing damage to certain computers by transmission of a program, information, code, or command: Up to one year in prison for a first offense, and up to 10 years if the damage was intentional, caused loss or impairment of medical services, or affected more than 10 computers.
• Trafficking in passwords or other means of unauthorized access to a computer: Up to one year in prison for a first offense and up to 10 years if the trafficking affected a government computer or was done for commercial or private gain.
• Making extortionate threats to harm a computer or based on information obtained through unauthorized access to a computer: Up to five years in prison for a first offense and up to 10 years for a subsequent offense.

In addition to these criminal penalties, the CFAA also allows victims of computer crimes to sue the offenders for compensatory damages and injunctive relief in civil court. The CFAA also provides for forfeiture and restitution of any property used or intended to be used to commit or facilitate the offense.

Do I Need a Lawyer for Help With the Computer Fraud and Abuse Act?

If you believe you’re facing potential allegations under the CFAA or need guidance on compliance with cyberspace law, consult a knowledgeable entertainment lawyer. The realm of computer crimes is intricate, and the penalties for violations can be severe.

At LegalMatch, we can assist you in finding the right attorney with experience in computer fraud law, ensuring your rights are defended and that you’re moved safely through the legal system.