Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act and Related Statutes

Congressional research reportMay 16, 2023

Ask Donna

What actually matters in this document.

Text

Cybercrime and the Law: Primer on the

Computer Fraud and Abuse Act and Related

Statutes

May 16, 2023

Congressional Research Service

https://crsreports.congress.gov

R47557

SUMMARY

Cybercrime and the Law: Primer on the

Computer Fraud and Abuse Act and Related

Statutes

R47557

May 16, 2023

Peter G. Berris

Legislative Attorney

There is no single, straightforward definition of cybercrime under federal law. Rather, depending

on the context, “cybercrime” may refer to all crimes involving computers, or only to crimes

targeting computers, or to crimes unique to the computer context. Regardless, federal prosecutors

have a number of statutory tools to charge conduct that fits within these varying conceptualizations of cybercrime.

One example of a federal cybercrime provision is the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030—a law

prohibiting a variety of computer-related conduct and providing for both civil and criminal penalties. Although sometimes

described as an anti-hacking law, the CFAA covers more than just hacking. The statute prohibits seven categories of conduct

involving unauthorized access to computers, including, with certain exceptions and conditions:

•

Obtaining national security information through unauthorized computer access and sharing or retaining it;

•

Trafficking in passwords or other means of unauthorized access to a computer;

Obtaining certain types of information through unauthorized computer access;

Accessing government computers without authorization;

Engaging in computer-based frauds through unauthorized computer access;

Knowingly causing damage to certain computers by transmission of a program, information, code, or

command;

Making extortionate threats to harm a computer or based on information obtained through unauthorized

access to a computer.

In addition to hacking, some types of cybercrime may include data theft, swatting, doxing, cyberstalking, cyber harassment,

unlawful access to electronic communications, or fraud. To the extent that conduct in these categories involves unauthorized

computer access, the CFAA may provide a powerful statutory tool to prosecute. Depending on the circumstances, prosecutors

may also look to a number of other statutes in their charging decisions. For example, data theft targeting trade secrets may

violate the Economic Espionage Act. Cyber harassment and cyberstalking might run afoul of the federal cyberstalking statute

(18 U.S.C. § 2261A(2)). Swatting—that is, reporting a false emergency in an attempt to direct an armed police response to a

target or location—may violate a federal law proscribing the transmission of certain threats in interstate commerce. When it

targets certain federal officials, doxing—obtaining another individual’s personal identifying information (such as an address,

telephone number, or Social Security Number) and posting it online for harassment or other purposes—may incur penalties

under a federal statute restricting the disclosure of personal information. The unlawful access of communications—such as

emails and texts—might potentially violate statutes such as the Wiretap Act. Finally, one frequently used prosecutorial tool

relevant to the cybercrime context is the federal wire fraud statute, 18 U.S.C. § 1343, which authorizes criminal penalties for

knowing or willing participation in a scheme to defraud using interstate wires. The wire fraud statute provides an additional

statutory tool to prosecute some conduct that may also violate the CFAA, and an alternate tool to charge electronic fraud that

does not involve unauthorized computer access as required by the CFAA’s cyber-fraud provisions.

The ubiquity of computers—and the myriad ways in which they may be used or targeted by criminals—means there is no

shortage of cybercrime issues of potential legislative interest to Congress. For example, Congress may wish to consider

creating new criminal penalties for conduct like doxing or trafficking in botnets (networks of compromised computers used

to perpetrate various cybercrimes). Congress may also be interested in establishing additional penalties for cybercrimes with

particular targets such as those impacting critical infrastructure. Alternatively, Congress may seek solutions outside of

criminal law to provide for other means of responding to cybercrimes—as in the case of legislative proposals that would

explore or facilitate hacking back against cyber attackers. In recent Congresses, Members have introduced proposals on each

of these topics.

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

Contents

Introduction ..................................................................................................................................... 1

The Computer Fraud and Abuse Act ............................................................................................... 3

History of the CFAA ................................................................................................................. 3

Overview of the CFAA ............................................................................................................. 5

Key CFAA Terms ................................................................................................................ 5

Prohibited Conduct Under the CFAA ................................................................................ 11

Remedies and Penalties..................................................................................................... 25

Other Cybercrimes ........................................................................................................................ 29

Data Theft................................................................................................................................ 29

Swatting, Doxing, Cyberstalking, and Cyber Harassment ...................................................... 31

Unlawful Access to Electronic Communications .................................................................... 34

Other Electronic Fraud ............................................................................................................ 36

Challenges in Prosecuting Cybercrimes Originating Abroad ........................................................ 38

Congressional Considerations ....................................................................................................... 40

Botnet Trafficking ................................................................................................................... 40

“Hacking Back” ...................................................................................................................... 44

Critical Infrastructure .............................................................................................................. 46

Doxing and Swatting ............................................................................................................... 48

The Insider Threat ................................................................................................................... 49

Tables

Table 1. Overview of CFAA Maximum Penalties ......................................................................... 26

Table 2. Overview of Maximum Penalties Under 18 U.S.C. § 1030(a)(2) ................................... 27

Table 3. Overview of Maximum Penalties Under 18 U.S.C. § 1030(a)(5)(A) .............................. 27

Table 4. Overview of Maximum Penalties Under 18 U.S.C. § 1030(a)(5)(B) .............................. 28

Contacts

Author Information........................................................................................................................ 53

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

Introduction

Computers are more prevalent than ever before.1 Their ubiquity has made them a favored tool for,

and target of, criminals.2 In 2022—the most recent year for which data is available—the FBI’s

Internet Crime Complaint Center received 800,944 reported complaints of cybercrime with

potential “losses exceeding $10.3 billion.”3 Numerous headline-grabbing incidents further

underscore the frequent and evolving connection between computers and crime. For example, in

May 2021, a ransomware attack prompted the Colonial Pipeline Company to shut down its

network temporarily, impacting gasoline availability and prices4 before the company reportedly

paid a ransom of over $4 million worth of Bitcoin.5 In January 2022, the International Committee

of the Red Cross announced that cyber attackers had obtained “personal data belonging to more

than 515,000 people worldwide” from its systems.6 In March 2022, hackers reportedly stole

cryptocurrency valued in the hundreds of millions of dollars from a service called Ronin.7 In

December 2022, federal authorities arrested two Queens, New York residents, whom they alleged

conspired with Russian hackers to “hack the electronic taxi dispatch system” at John F. Kennedy

1 According to the United States Census Bureau (Census Bureau), by one measure, only 8% of households had a

computer in 1984. MICHAEL MARTIN, U.S. CENSUS BUREAU, COMPUTER AND INTERNET USE IN THE UNITED STATES:

2018, at 4 (2021), https://www.census.gov/content/dam/Census/library/publications/2021/acs/acs-49.pdf. According to

the same report, 92% of households had a computer in 2018. Id. The prevalence of computers may also be inferred

from the estimated number of computerized devices such as smart appliances and fitness trackers connected to the

Internet of Things (IoT)—by one account, there will be 21.5 billion such active devices connected to the IoT by 2025.

CRS In Focus IF11239, The Internet of Things (IoT): An Overview, by Patricia Moloney Figliola. For a review of

Computer Fraud and Abuse Act (CFAA) issues unique to the IoT, see generally Sara Sun Beale & Peter Berris,

Hacking the Internet of Things: Vulnerabilities, Dangers, and Legal Responses, 16 DUKE L. & TECH. REV. 161, 162

(2018). As discussed below, these devices are considered computers in the context of the CFAA. See infra Section

“Protected Computers.”

2 See, e.g., Oversight of the Federal Bureau of Investigation: Hearing Before the S. Comm. on the Judiciary, 117th

Cong. 5–9 (2022) (statement of Christopher A. Wray, Director, Fed. Bureau of Investigation) (discussing nature of

current cyber threats).

3 FED. BUREAU OF INVESTIGATION, INTERNET CRIME REPORT 2022, at 7 (2023),

https://www.ic3.gov/Media/PDF/AnnualReport/2022_IC3Report.pdf; see also, Press Release, Fed. Bureau of

Investigation Springfield, Internet Crime Complaint Center Releases 2022 Statistics (Mar. 22, 2023),

https://www.fbi.gov/contact-us/field-offices/springfield/news/internet-crime-complaint-center-releases-2022-statistics.

4 CRS Insight IN11667, Colonial Pipeline: The DarkSide Strikes, by Paul W. Parfomak and Chris Jaikaran; see

generally Stephanie Kelly & Laura Sanicola, U.S. Capital Running Out of Gas, Even as Colonial Pipeline Recovers,

REUTERS (May 14, 2021), https://www.reuters.com/business/energy/colonial-pipeline-ramps-up-us-seeks-emerge-fuelcrunch-2021-05-14/; Brett Molina & Nathan Bomey, Colonial Pipeline Restarted Operations, Owners Say “It Will

Take Several Days” For Supply Chain to Return to Normal, USA TODAY (May 12, 2021),

https://www.usatoday.com/story/money/2021/05/12/gas-shortage-gas-prices-colonial-pipeline-nc-virginia-northcarolina/5052551001/; Catherine Thorbecke, Gas Hits Highest Price in 6 Years, Fuel Outages Persist Despite Colonial

Pipeline Restart, ABC NEWS (May 17, 2021), https://abcnews.go.com/US/gas-hits-highest-price-years-fuel-outagespersist/story?id=77735010.

5 Cathy Bussewitz, Colonial Pipeline Confirms It Paid $4.4M to Hackers, AP NEWS (May 19, 2021),

https://apnews.com/article/hacking-technology-business-ed1556556c7af6220e6990978ab4f745.

6 Cyber-attack on ICRC: What we Know, INT’L COMM. OF THE RED CROSS (Feb. 16, 2022),

https://www.icrc.org/en/document/cyber-attack-icrc-what-we-know.

7 Rob Lever, Data Breaches in 2022, U.S. NEWS & WORLD REPORT (Oct. 28, 2022), https://www.usnews.com/360reviews/privacy/recent-data-breaches; Tom Wilson & Elizabeth Howcroft, Blockchain Project Ronin Hit by $615

Million Crypto Heist, REUTERS (Mar. 29, 2022), https://www.reuters.com/technology/blockchain-company-ronin-hitby-615-million-crypto-heist-2022-03-29/.

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

International Airport and used their unauthorized access to charge drivers a fee to skip the taxi

queue.8

The world of computer-based crime extends beyond financially motivated hacking. Examples

abound of criminals using computers and the internet to threaten9 and stalk,10 among other things.

Conceptually, the true scope of cybercrime or computer crime depends in part on definitions.11

Depending on the context, “cybercrime” might refer specifically to crimes requiring the use of a

computer, such as hacking, or to traditional crimes when they involve use of a computer or the

internet, like harassment.12 This report uses the term cybercrime somewhat broadly to include

both crimes unique to the computer context and some traditional crimes that may be committed

using computers.13 The report focuses mainly on the Computer Fraud and Abuse Act (CFAA)—a

primary tool in prosecuting cybercrimes like hacking and ransomware attacks at the federal

level.14 The report discusses key CFAA terms and summarizes its substantive prohibitions, then

provides an overview of remedies and penalties under the statute. Many cybercrimes may

implicate federal statutes other than, or in addition to, the CFAA.15 Thus, the report briefly

discusses some of these crimes, such as cyberstalking, and identifies statutes that may be used to

8 Indictment, United States v. Abayev, No. 22 Crim. 655 (S.D.N.Y. Dec. 5, 2022); Press Release, U.S. Dep’t of

Just., Two Men Arrested For Conspiring With Russian Nationals To Hack The Taxi Dispatch System At JFK Airport

(Dec. 20, 2022), https://www.justice.gov/usao-sdny/pr/two-men-arrested-conspiring-russian-nationals-hack-taxidispatch-system-jfk-airport.

9 E.g., Press Release, U.S. Dep’t of Just., Connecticut Man Pleads Guilty to Cyberstalking and Threatening

Massachusetts Woman (Sep. 7, 2022), https://www.justice.gov/usao-ma/pr/connecticut-man-pleads-guiltycyberstalking-and-threatening-massachusetts-woman; Press Release, U.S. Dep’t of Just., Man Arrested for Making

Threats of Violence Against FBI (Aug. 15, 2022), https://www.justice.gov/opa/pr/man-arrested-making-threatsviolence-against-fbi; Press Release, U.S. Dep’t of Just., New Jersey Man Pleads Guilty to Threatening Employees of

Latino Civil Rights Organizations (Oct. 20, 2010), https://www.justice.gov/opa/pr/new-jersey-man-pleads-guiltythreatening-employees-latino-civil-rights-organizations.

10 E.g., Press Release, U.S. Dep’t of Just., Two Former eBay Employees Sentenced for Aggressive Cyberstalking

Campaign (Oct. 11, 2022), https://www.justice.gov/usao-ma/pr/two-former-ebay-employees-sentenced-aggressivecyberstalking-campaign; Press Release, U.S. Dep’t of Just., Deputy U.S. Marshal Charged with Cyberstalking and

Perjury (Mar. 14, 2021), https://www.justice.gov/opa/pr/deputy-us-marshal-charged-cyberstalking-and-perjury; Press

Release, U.S. Dep’t of Just., Florida Man Sentenced for Racially-Motivated Interference with Election in

Charlottesville, Virginia and for Cyberstalking in Florida (Aug. 31, 2020), https://www.justice.gov/opa/pr/florida-mansentenced-racially-motivated-interference-election-charlottesville-virginia-and.

11 This report uses the phrases cybercrime and computer crime interchangeably.

12 See, e.g., ORIN S. KERR, COMPUTER CRIME LAW 1 (5th ed. 2022) (“Substantive computer crime law divides into two

basic categories: computer misuse crimes and traditional crimes.”); COMPUT. CRIME & INTELL. PROP. SECTION, CRIM.

DIV., U.S. DEP’T OF JUST., PROSECUTING COMPUTER CRIMES (2015), https://www.justice.gov/sites/default/files/criminalccips/legacy/2015/01/14/ccmanual.pdf (defining computer crime, cybercrime, and network crime in relation to “ those

crimes that use or target computer networks”); Crime, BLACK'S LAW DICTIONARY (11th ed. 2019) (defining computer

crime as “[a] crime involving the use of a computer, such as sabotaging or stealing electronically stored data”);

Cybercrime, NEW OXFORD AMERICAN DICTIONARY (1st ed. 2005) (defining cybercrime as “crime conducted via the

Internet or some other computer network”); Cybercrime, BRITANNICA (2022),

https://www.britannica.com/topic/cybercrime (defining cybercrime, “also called computer crime,” as “the use of a

computer as an instrument to further illegal ends, such as committing fraud, trafficking in child pornography and

intellectual property, stealing identities, or violating privacy”).

13 For further discussion of how to conceptualize cybercrime, see generally KERR, supra note 12, at 1–3.

14 See U.S. DEP’T OF JUST., JUSTICE MANUAL § 9-48.000 (2022), https://www.justice.gov/jm/jm-9-48000-computerfraud (describing importance of CFAA in “address[ing] cyber-based crimes”).

15 Given the large number of federal criminal provisions, it is not possible to provide a comprehensive overview of

federal laws that may apply to every example of crime involving computers. See, e.g., Van Buren v. United States, 141

S. Ct. 1648, 1669 (2021) (Thomas, J., dissenting) (“The number of federal laws and regulations that trigger criminal

penalties may be as high as several hundred thousand.”).

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

prosecute them at the federal level. The report concludes with a discussion of congressional

considerations.

The Computer Fraud and Abuse Act

Congress was prescient about the ubiquity of cybercrime nearly 40 years ago when it enacted the

CFAA—a civil16 and criminal law that prohibits a range of computer-based acts.17 While a

number of federal statutes may be relevant to combatting nefarious computer activities such as

those discussed above,18 the CFAA is perhaps the most relevant.19Among other things, the CFAA

prohibits a person from trespassing into, damaging, or acquiring information from certain

categories of computers, assuming the user lacks authorization for that conduct.20 Prosecutors

invoke the CFAA to combat a variety of malign computer-based activities.21

History of the CFAA

By many accounts, the history of the CFAA begins with a movie—the 1983 thriller WarGames22

starring Matthew Broderick.23 In WarGames, Broderick’s character, a rebellious high school

student, nearly starts World War III when he accidentally accesses the computer system

controlling the United States nuclear arsenal, mistaking the system for an interactive video

game.24 The movie’s depiction of the dangers of the computer age—where even nuclear

annihilation could be a few keystrokes away—was not lost on policy makers.25 According to one

16 This report cites to civil CFAA opinions despite focusing on cybercrime, as “most of the published cases interpreting

§ 1030 arise in the civil context rather than the criminal context.” KERR, supra note 12, at 31. Further, courts “must

interpret the statute consistently, whether [they] encounter its application in a criminal or noncriminal context.” hiQ

Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1200 (9th Cir. 2022) (quoting Leocal v. Ashcroft, 543 U.S. 1, 12 n.8,

(2004); see also ORIN S. KERR, COMPUTER CRIME LAW 75 (3d ed. 2013) (“Courts generally use civil and criminal

interpretations of federal statutes interchangeably absent an indication that Congress intended a contrary approach.”).

17 H.R. REP. NO. 98-894, at 10 (1984) (“[B]y combining the ubiquity of the telephone with the capability of the

personal computer, a whole new dimension of criminal activity becomes possible.”).

18 For example, relevant provisions might include, among others, federal laws criminalizing wire fraud under 18 U.S.C.

§ 1343, cyberstalking under 18 U.S.C. § 2261A, the interception of electronic communications under 18 U.S.C. § 2511,

or the unlawful access of stored communications under 18 U.S.C. § 2701. See infra “Other Cybercrimes.”

19 See, e.g., John P. Carlin, Detect, Disrupt, Deter: A Whole-of-Government Approach to National Security Cyber

Threats, 7 HARV. NAT'L SEC. J. 391, 418–19 (2016) (describing the CFAA as a “cornerstone” statute and the “most

important” of the “wide array of statutes that address the full life cycle of a national security cyber threat”); Michael L.

Rustad, Private Enforcement of Cybercrime on the Electronic Frontier, 11 S. CAL. INTERDISC. L.J. 63, 89 (2001)

(naming the CFAA as “the single most important federal statute governing computer crime”).

20 18 U.S.C. § 1030.

21 See infra Section “Prohibited Conduct Under the CFAA.”

22 WARGAMES (Metro-Goldwyn-Mayer Studios 1983).

23 See Fred Kaplan, ‘WarGames’ and Cybersecurity’s Debt to a Hollywood Hack, N.Y. TIMES (Feb. 19, 2016),

https://www.nytimes.com/2016/02/21/movies/wargames-and-cybersecuritys-debt-to-a-hollywood-hack.html

(describing the birth of federal cybersecurity laws following President Ronald Reagan’s concern over the movie); Ivan

Evtimov, et al., Is Tricking A Robot Hacking?, 34 BERKELEY TECH. L.J. 891, 904 (2019) (“According to popular lore,

President Reagan saw the movie War Games and met with his national security advisers the next day to discuss

America’s cyber vulnerabilities. The CFAA is said to be the result of their deliberations.”); Jay P. Kesan & Carol M.

Hayes, Mitigative Counterstriking: Self-Defense and Deterrence in Cyberspace, 25 HARV. J.L. & TECH. 429, 492

(2012) (“There is some evidence that when the CFAA was originally enacted in 1984, it was partially in response to the

situations depicted in the action film WarGames.”).

24 See Roger Ebert, WarGames, ROGEREBERT.COM (June 3, 1983), https://www.rogerebert.com/reviews/wargames1983 (reviewing and summarizing plot of WarGames).

25 H.R. REP. NO. 98-894, at 10 (1984) (referencing WarGames in discussion of necessity of computer fraud legislation).

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

report, after viewing WarGames at Camp David, President Ronald Reagan asked advisers and the

chairman of the Joint Chiefs of Staff whether the plot of the movie was possible.26 The CFAA is

sometimes “said to be the [eventual] result of their deliberations,”27 although congressional

interest in computer crimes may be traced back at least as far as the 1970s.28

The first major federal computer-crime enactment came in the form of the Counterfeit Access

Device and Computer Fraud and Abuse Act of 1984 (the 1984 Act).29 With exceptions, the law

prohibited three subsets of computer-based conduct: (1) obtaining national security information

through unauthorized computer access; (2) obtaining financial information through unauthorized

computer access; and (3) trespassing into a government computer and “knowingly us[ing],

modif[ying], destroy[ing], or disclos[ing] information” on that computer.30 The 1984 Act was

relatively narrow,31 and the Department of Justice (DOJ) expressed concern that it made computer

crime prosecutions difficult.32 In 1986, Congress substantially amended the 1984 Act, and the

modern CFAA has many of its roots in that 1986 amendment.33 Among other things, the 1986

amendment modified intent requirements and prohibited new categories of conduct including

password trafficking, damaging computers, and accessing computers with intent to defraud.34

Since 1986, Congress has amended the CFAA on numerous occasions,35 broadening both the

scope of conduct prohibited by the statute and the scope of computers protected.36 Today, the

CFAA is the main federal37 computer misuse statute.38

26 Kaplan, supra note 23.

27 Evtimov, supra note 23, at 904.

28 E.g., S. COMM. ON GOV’T OPERATIONS, 94TH CONG., PROBLEMS ASSOCIATED WITH COMPUTER TECHNOLOGY IN

FEDERAL PROGRAMS AND PRIVATE INDUSTRY—COMPUTER ABUSES (Comm. Print 1976).

29 See WEC Carolina Energy Sols. LLC v. Miller, 687 F.3d 199, 201 (4th Cir. 2012) (“In 1984, Congress initiated a

campaign against computer crime by passing the Counterfeit Access Device and Computer Fraud and Abuse Act of

1984.”); Orin S. Kerr, Cybercrime’s Scope: Interpreting “Access” and “Authorization” in Computer Misuse Statutes,

78 N.Y.U. L. REV. 1596, 1615 (2003) (“Congress enacted the first federal computer crime law in 1984.”).

30 P.L. 98-473, § 2102, 98 Stat. 1837 (1984) (codified at 18 U.S.C. § 1030).

31 For instance, the 1984 Act “was limited to a narrow range of computers—namely, those containing national security

information or financial data and those operated by or on behalf of the government.” hiQ Labs, Inc. v. LinkedIn Corp.,

31 F.4th 1180, 1197 (9th Cir. 2022).

32 See S. REP. NO. 99-432, at 6–9 (1986) (summarizing concerns expressed by DOJ).

33 Kerr, supra note 29, at 1598 n.11, 1615.

34 Computer Fraud and Abuse Act of 1986, P.L. 99-474, 100 Stat. 1213 (codified as amended at 18 U.S.C. § 1030).

35 E.g., Anti-Drug Abuse Act of 1988, P.L. 100-690, 102 Stat. 4181; Financial Institutions Reform, Recovery, and

Enforcement Act of 1989, P.L. 101-73, 103 Stat. 183; Crime Control Act of 1990, Pub. L. No. 101–647, 104 Stat.

4789; Violent Crime Control Act of 1994, Pub. L. No. 103–322, 108 Stat. 1796 ; Economic Espionage Act of 1996,

Pub. L. No. 104–294, 110 Stat. 3488; Uniting and Strengthening America by Providing Appropriate Tools Required To

Intercept and Obstruct Terrorism (USA PATRIOT ACT) Act of 2001, Pub. L. No. 107–56,115 Stat. 272; 21st Century

Department of Justice Appropriations Authorization Act, Pub. L. No. 107-273, 116 Stat. 1758 (2002); Homeland

Security Act of 2002, Pub. L. No. 107-296, 116 Stat. 2135; Former Vice President Protection Act of 2008, Pub. L. No.

110-326, 122 Stat. 3560.

36 See COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 1–2.

37 The CFAA exists against the backdrop of numerous state computer crime laws that are beyond the scope of this

report. E.g., VT. STAT. ANN. tit. 13, §§ 4101–07 (1999). Computer misuse statutes have been enacted in “all fifty

states.... ” KERR, supra note 12, at 29; accord Computer Crime Statutes, NAT’L CONF. OF STATE LEGISLATURES (Feb.

24, 2020), https://www.ncsl.org/research/telecommunications-and-information-technology/computer-hacking-andunauthorized-access-laws.aspx (surveying computer crime laws of all 50 states).

38 See KERR, supra note 12, at 30 (describing CFAA as “the federal computer misuse statute”); see also Evtimov, supra

note 23, at 904 (“Since its implementation, the CFAA has been the nation’s predominant anti-hacking law.”).

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

Overview of the CFAA

Key CFAA Terms

Although prosecutors may use the CFAA to charge hacking,39 and courts and observers have

described the CFAA as an anti-hacking statute,40 the word “hacking” does not appear in any of its

various provisions.41 Instead, the statute criminalizes several categories of conduct that include

many types of computer hacking as well as a variety of other computer-based activities.42

Generally, the CFAA prohibits certain conduct that is carried out by an individual “without

authorization” or who “exceeds authorized access,” and that involves a computer or a “protected

computer.”43 Two criminal provisions impose liability for conduct relating to “damage” to a

computer.44 Thus, the scope of the CFAA turns largely on the meaning of these terms, which are

discussed below.

Computer

The CFAA broadly45 defines “computer” as any “electronic, magnetic, optical, electrochemical,

or other high speed data processing device performing logical, arithmetic, or storage functions,”

including “any data storage facility or communications facility directly related to or operating in

conjunction with such device.... ”46 The CFAA excludes only automated typewriters, typesetters,

portable hand held calculators, and similar devices from its definition of computer.47 These

limited exceptions “show just how general” the statute’s definition of computer is.48 As one court

explained, the definition includes any device with an electronic data processor, of which there are

numerous examples.49 Thus, under the CFAA, computers include not only laptops and desktops,

but also a wide array of computerized devices ranging from cellphones to objects embedded with

microchips, such as certain microwave ovens, watches, and televisions.50

Protected Computers

Several provisions of the CFAA specifically concern “protected computers.”51 Among other

things, the CFAA defines protected computers as those that are either “exclusively for the use of a

39 See infra Section “Prohibited Conduct Under the CFAA.”

40 E.g., United States v. Nosal (Nosal I), 676 F.3d 854, 857 (9th Cir. 2012); Evtimov, supra note 23, at 904.

41 See 18 U.S.C. § 1030 (proscribing various conduct without use of the word “hacking”).

42 Id.

43 See, e.g., id. § 1030(a)(2) (prohibiting “intentionally access[ing] a computer without authorization” or in excess of

authorization, and obtaining certain types of information, including from a “protected computer” (emphasis added)).

44 Id. § 1030(a)(5), (a)(7).

45 See United States v. Mitra, 405 F.3d 492, 495 (7th Cir. 2005) (discussing breadth of CFAA with respect to the types

of computers it governs).

46 18 U.S.C. § 1030(e)(1).

47 Id.

48 Mitra, 405 F.3d at 495 (emphasis omitted).

49 United States v. Kramer, 631 F.3d 900, 902 (8th Cir. 2011).

50 Id. at 902–03; accord United States v. Nosal (Nosal II), 844 F.3d 1024, 1050 (9th Cir. 2016) (Reinhardt, J.,

dissenting) (“This means that nearly all desktops, laptops, servers, smart-phones, as well as any ‘iPad, Kindle, Nook,

X–box, Blu–Ray player or any other Internet-enabled device,’ including even some thermostats qualify as [protected

computers].” (quoting United States v. Nosal (Nosal I), 676 F.3d 854, 861 (9th Cir. 2012))).

51 18 U.S.C. § 1030.

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

financial institution or the United States Government” or that are “used in or affecting interstate

or foreign commerce or communication.... ”52 Courts have construed the latter phrase to include

any computer connected to the internet.53 Thus, most modern computing devices are subject to

the CFAA’s protections, including devices such as smart appliances and fitness trackers connected

to the Internet of Things54—“a system of interrelated devices connected to a network and/or to

one another, exchanging data without necessarily requiring human-to-machine interaction.”55

Another important type of computer that fits within the definition of protected computer is a

server—a computer that manages website data and other information.56 For example, one court

concluded that the web servers storing and sharing the member data of a large social media

website qualified as protected computers.57

Without Authorization and Exceeds Authorized Access

The CFAA applies only if the defendant acts “without authorization” or “exceeds authorized

access.”58 For example, Section 1030(a)(2) prohibits intentionally accessing a computer without

authorization or in excess of authorization and obtaining information from a financial institution,

the federal government, or a protected computer.59 Other provisions contain nearly identical

requirements.60

52 Id. § 1030(e)(2). A 2020 amendment to the CFAA expanded the definition of “protected computer” to include any

computer that “is part of a voting system; and ... is used for the management, support, or administration of a Federal

election; or ... has moved in or otherwise affects interstate or foreign commerce.” Defending the Integrity of Voting

Systems Act, Pub. L. 116-179, 134 Stat. 855 (2020) (codified in relevant part at 18 U.S.C. § 1030(e)(2)(C)).

53 See, e.g., Van Buren v. United States, 141 S. Ct. 1648, 1652 (2021) (interpreting the definition of protected computer

in the context of one subsection of the CFAA to include “all computers that connect to the Internet”); hiQ Labs, Inc. v.

LinkedIn Corp., 31 F.4th 1180, 1195 (9th Cir. 2022) (“The term ‘protected computer’ refers to any computer ‘used in

or affecting interstate or foreign commerce or communication[]’—effectively any computer connected to the Internet.”

(quoting 18 U.S.C. § 1030(e)(2)(B)) (internal citations omitted)).

54 Although federal cases specifically examining the CFAA’s applicability in the context of the Internet of Things are

scarce, a number of observers have concluded that internet-enabled objects qualify as protected computers. Orin S.

Kerr, Vagueness Challenges to the Computer Fraud and Abuse Act, 94 MINN. L. REV. 1561, 1577–78 (2010); accord

Beale & Berris, supra note 1, at 170.

In one case, federal prosecutors used the CFAA to charge defendants who allegedly gained unauthorized access to Ring

smart devices. Indictment, United States v. Nelson and McCarthy, No. 2:22-cr-00598-JAK (C.D. Cal. Dec. 16, 2022).

Another example from case law is United States v. Peterson. 776 F. App’x 533 (9th Cir. 2019). In Peterson, the U.S.

Court of Appeals for the Ninth Circuit considered a vagueness challenge to a condition of supervised release imposed

on a defendant convicted of possessing child pornography. Id. at 533. The condition at issue restricted the defendant

from accessing a computer as defined by the CFAA. Id. at 534. In agreeing with the defendant that the condition was

potentially overbroad, the court observed that a wide range of objects fall within the definition of computer under the

CFAA, including “refrigerators with Internet connectivity, Fitbit™ watches” and certain automobiles. Id. at 535 n.3.

Although the court did not discuss these devices in relation to the phrase “protected computer,” it described them in a

manner that would satisfy the definition of protected computer under the CFAA; as the court indicated, Internet of

Things devices are (1) computers (2) connected to the internet. Id. at 534. For a similar example, see United States v.

Wells, 29 F.4th 580, 588 (9th Cir. 2022), cert. denied, 143 S. Ct. 267 (2022).

55 CRS In Focus IF11239, The Internet of Things (IoT): An Overview, by Patricia Moloney Figliola.

56 hiQ Labs, 31 F.4th at 1195.

57 Id.

58 18 U.S.C. § 1030.

59 Id. § 1030(a)(2).

60 See generally id. § 1030.

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

While the CFAA repeatedly uses the phrases “exceeds authorized access” and “without

authorization,” the statute does not fully define either phrase.61 In fact, the statute offers no

definition for “without authorization.”62 The CFAA does explain that “exceeds authorized access”

means “access[ing] a computer with authorization and us[ing] such access to obtain or alter

information in the computer that the accesser is not entitled so to obtain or alter,” but that

definition hinges on the meaning of the undefined phrase “with authorization.”63

On a more fundamental level, the meaning of authorization—the common concept in “exceeds

authorized access” and “without authorization”—is also undefined by the CFAA.64 As a result,

case law is still developing with respect to what it means to be an authorized computer user.

In hiQ Labs, Inc. v. LinkedIn Corp., the Ninth Circuit65 suggested that authorization depends on

the computer systems at issue and described three categories.66 The first category encompasses

computers where authorization is not required for access in the first place.67 For example, the

Ninth Circuit said that computers that are “open to the general public” to access fall in this

category.68 The category potentially includes servers for publicly accessible websites, since a

“defining feature of public websites is that their publicly available sections lack limitations on

access; instead, those sections are open to anyone with a web browser.”69 The second category is

comprised of computers “for which authorization is required and has been given.”70 This category

might include, for example, scenarios where an employer provides an employee with password

credentials to enter a company computer.71 Third, there are computers or areas of computer

systems “for which authorization is required but has not been given.”72

The third category poses a crucial question: in what way must the owner of a computer restrict

access so that authorization is not given?73 Federal case law on this question is unresolved. In the

2021 opinion Van Buren v. United States, which marked the Supreme Court’s first significant

foray into the CFAA, the Court described limits on authorization as “gates.”74 The Van Buren

Court explained that assessing authorization under the CFAA is “a gates-up-or-down inquiry”

where “one either can or cannot access a computer system, and one either can or cannot access

certain areas within the system.”75 Van Buren did not define “gate” but seemed to assume that

61 Id.

62 Id. § 1030(e).

63 Id. (emphasis added).

64 Id. § 1030.

65 This report references a significant number of decisions by federal appellate courts of various regional circuits. For

purposes of brevity, references to a particular circuit in the body of this report (e.g., the Ninth Circuit) refer to the U.S.

Court of Appeals for that particular circuit.

66 31 F.4th 1180, 1197–98 (9th Cir. 2022).

67 Id.

68 Id.

69 Id. at 1199.

70 Id. at 1198.

71 A number of CFAA cases involve authorization to access computers by virtue of employment and more specifically

address what happens to that authorization when the employment ends. E.g., United States v. Nosal (Nosal II), 844

F.3d, 1024, 1038 (9th Cir. 2016).

72 hiQ Labs, 31 F.4th at 1198.

73 See generally Patricia L. Bellia, A Code-Based Approach to Unauthorized Access Under the Computer Fraud and

Abuse Act, 84 GEO. WASH. L. REV. 1442, 1444–60 (2016) (discussing five paradigms for conceptualizing the limits of

authorization).

74 Van Buren v. United States, 141 S. Ct. 1648, 1658 (2021).

75 Id. at 1658–59.

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

technological limitations76 such as password requirements constitute a “gate” or limitation on

access.77 In a footnote, however, Van Buren left open the possibility that other gates may exist as

well, including “limits contained in contracts or policies.”78 Beyond this discussion, the Court left

uncertainty as to what means may be used to limit authorization for CFAA purposes.79 In other

words, an unresolved question is what “gates” effectively limit a user’s authorization.80

However, in many respects, Van Buren appears to foreclose imposing CFAA liability for mere

violations of Terms of Service agreements (ToS)—contractual restrictions on computer use.81 The

Van Buren Court held that the CFAA does not criminalize accessing computers for unauthorized

purposes.82 Thus, to the extent a contractual restriction such as a ToS limits the purposes for

which an individual may access information on a computer—such as an employer policy limiting

access to a system for business purposes—violating such restrictions would not incur CFAA

liability under Van Buren.83

Delineating the concept of authorization, and its limits, requires reference to the statutory phrases

“exceeds authorized access” and “without authorization,” which describe when an individual

lacks authorization for CFAA purposes.84 Both phrases are discussed below.

Without Authorization: As noted, the CFAA offers no definition for “without authorization.”85

However, at least in theory, Congress seemingly intended for “without authorization” to apply to

outsiders such as hackers,86 who are “wholly lacking in authority to access or use [the relevant]

computer.”87 Federal courts have generally interpreted “without authorization” to refer to

76 Some observers use the term “code-based” to describe technological limitations, e.g., Bellia supra, note 73, 1457, but

the Court has used the phrases “code-based” and “technological” interchangeably with respect to limitations on

authorization. Van Buren, 141 S. Ct. at 1659 n.8.

77 It questioned only whether other types of gates beyond technological limitations may also exist. See Van Buren, 141

S. Ct. at 1659 n.8 (“For present purposes, we need not address whether this inquiry turns only on technological (or

‘code-based’) limitations on access, or instead also looks to limits contained in contracts or policies.” (emphasis

added)).

78 Id.

79 Id.

80 Id.

81 Even before Van Buren, some federal courts had concluded that the void-for-vagueness doctrine potentially limited

CFAA prosecution for mere terms of service violations. See generally, e.g., United States v. Drew, 259 F.R.D. 449, 467

(C.D. Cal. 2009). Also prior to Van Buren, there was an unresolved circuit split over whether the CFAA could impose

criminal liability for ToS violations, as a result of conflicting interpretations of the breadth of the phrases “without

authorization” and “exceeds authorized access.” Compare, e.g., EF Cultural Travel BV v. Zefer Corp., 318 F.3d 58, 62

(1st Cir. 2003) (“A lack of authorization could be established by an explicit statement on the website restricting

access.”) with, e.g., United States v. Nosal (Nosal I), 676 F.3d 854, 863 (9th Cir. 2012) (“Instead, we hold that the

phrase ‘exceeds authorized access’ in the CFAA does not extend to violations of use restrictions.”).

82 Van Buren, 141 S. Ct. at 1662.

83 Id.

84 See, e.g., hiQ Labs v. LinkedIn Corp., 938 F.3d 985, 1003 (9th Cir. 2019), aff’d, 31 F.4th 1180 (9th Cir. 2022)

(exploring limits of authorization based on whether use of a computer fell into the “without authorization” category as a

result of a cease and desist letter).

85 Id. § 1030(e).

86 S. REP. No. 104-357, at 9 (1996) (describing “outsiders” as those “who gain access to a computer without

authorization”).

87 S. REP. No. 99-432, at 8 (1986).

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

outsiders,88 and the Supreme Court appears to have approved of that conclusion in its 2021

opinion in Van Buren v. United States.89

Following Van Buren, a number of federal courts have examined what “gates” may cause

someone to be without authorization to access a computer. In hiQ Labs, Inc. v. LinkedIn Corp.,

the Ninth Circuit concluded that “the CFAA’s prohibition on accessing a computer ‘without

authorization’ is violated when a person circumvents a computer’s generally applicable rules

regarding access permissions, such as username and password requirements, to gain access to a

computer.”90 Thus, the Ninth Circuit held that an entity was not without authorization in violation

of the CFAA when it scraped data from a publicly-accessible website despite a cease and desist

letter.91 The court further held that “the concept of ‘without authorization’ does not apply to

public websites” in general.92 Using Van Buren’s “gates” metaphor for limits on authorization, the

Ninth Circuit explained that with respect to a “computer hosting publicly available webpages, that

computer has erected no gates to lift or lower in the first place.”93 According to the Ninth Circuit,

“[w]ith regard to websites made freely accessible on the Internet . . . the concept of ‘without

authorization’ is inapt.”94

Some federal district courts appear to have embraced a less restrictive interpretation of “without

authorization” than the Ninth Circuit.95 For instance, one court examined Van Buren and rejected

the assertion that “hacking a password is the only way that one can obtain access ‘without

authorization.’”96 That court concluded that a reasonable jury could determine that an individual

is “without authorization” when he accesses a webpage that is not password protected, but that he

believes was intended to be “password protected based on the obviously sensitive nature of the

information” on the page, and when he gained access by “guessing their likely URLs.”97 In an

unpublished opinion, one federal district court also concluded that an individual can be without

authorization if he accessed a computer in violation of ToS and multiple cease and desist letters.98

Subsequent to Van Buren, at least one federal district court has concluded that termination of

88 See, e.g., Sandvig v. Barr, 451 F. Supp. 3d 73, 86 (D.D.C. 2020) (collecting case law concluding that “without

authorization” encompasses individuals lacking any approval to access a computer, such as outside hackers); Pulte

Homes, Inc. v. Laborers’ Int’l Union of N. Am., 648 F.3d 295, 304 (6th Cir. 2011) (“[A] person who uses a computer

‘without authorization’ has no rights, limited or otherwise, to access the computer in question.” (quoting LVRC

Holdings LLC v. Brekka, 581 F.3d 1127, 1133 (9th Cir. 2009)) (emphasis omitted)).

89 141 S. Ct. 1648, 1658 (2021) (indicating that a view of “without authorization” that “protects computers themselves

by targeting so-called outside hackers” lacking any permission to access a computer “makes sense”); see also United

States v. Eddings, No. 5:19-CR-00535, 2021 WL 2527966, at *4 (E.D. Pa. June 21, 2021) (characterizing Van Buren as

agreeing that “without authorization” protects computers from outside hackers).

90 31 F.4th 1180, 1201 (9th Cir. 2022).

91 Id.

92 Id. at 1199.

93 Id.

94 Id. at 1198.

95 But see, e.g., Meta Platforms, Inc. v. BrandTotal Ltd., 605 F. Supp. 3d 1218, 1262 (N.D. Cal 2022) (quoting hiQ

Labs and holding that “where a website is made available to the public without any authentication requirement in at

least the first instance,” the phrase “without authorization” is inapplicable, “even if the owner employs technological

measures to block specific users, suspicious activity, or—as here—repeated access beyond a particular threshold”).

96 Vox Mktg. Grp. v. Prodigy Promos, 556 F. Supp. 3d 1280, 1285 (D. Utah 2021)

97 Id. at 1287.

98 ACI Payments, Inc. v. Conservice, LLC, No. 1:21-CV-00084-RJS-CMR, 2022 WL 622214, at *9 (D. Utah Mar. 3,

2022).

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

employment may revoke authorization and leave the former employee without authorization to

access a computer previously accessed by virtue of that employment.99

Exceeds Authorized Access: The meaning of the phrase “exceeds authorized access” long

divided federal courts.100 Prior to Van Buren, some federal appellate courts, including the First,101

Fifth,102 Seventh,103 and Eleventh104 Circuits, had adopted a broad view of the CFAA where “the

concept of ‘exceeds authorized access’ may include exceeding the purposes for which access is

‘authorized.’”105 In contrast, several other courts, including the Second,106 Fourth,107 and Ninth108

Circuits, had more narrowly interpreted “exceeds authorized access,” based on an understanding

that the CFAA’s central purpose is to criminalize hacking. These courts applied CFAA liability

only to those who lacked any authorization to access a computer or website109 or who were

“authorized to access only certain data or files” but accessed “unauthorized data or files.”110

In Van Buren, the Court appears to have interpreted the CFAA’s scope in a manner roughly

consistent with courts that had applied a narrow interpretation of the statute—reading “exceeds

authorized access” to exclude an individual who uses a computer for an inappropriate reason.111

The Van Buren court concluded that a police officer did not exceed authorized access when he

used a law enforcement database, which he was authorized to use “only for law enforcement

purposes,” to search for license plate information for personal profit.112 Thus, pursuant to Van

Buren, in order to “exceed authorized access” in violation of the CFAA, an individual must access

an area of a computer or information on a computer that is completely “off limits to him,” as

99 See Zap Cellular, Inc. v. Weintraub, No. 15-CV-6723-PKC-VMS, 2022 WL 4325746, at *7 (E.D.N.Y. Sept. 19,

2022) (distinguishing Van Buren and concluding that termination of CEO made him without authorization to access

computers and servers he was previously able to access only through his prior employment).

100 Van Buren v. United States, 210 L. Ed. 2d 26, 141 S. Ct. 1648, 1654 (2021) (referencing “split in authority

regarding the scope of liability under the CFAA’s ‘exceeds authorized access’ clause”).

101 EF Cultural Travel BV v. Zefer Corp., 318 F.3d 58, 62 (1st Cir. 2003) (“A lack of authorization could be established

by an explicit statement on the website restricting access.”).

102 United States v. John, 597 F.3d 263, 271 (5th Cir. 2010) (holding that authorized access may “encompass limits

placed on the use of information obtained by permitted access to a computer system and data available on that system

. . . at least when the user knows or reasonably should know that he or she is not authorized to access a computer and

information obtainable from that access in furtherance of or to perpetrate a crime”).

103 Int’l Airport Ctrs., LLC v. Citrin, 440 F.3d 418, 420–21 (7th Cir. 2006) (concluding that defendant lacked

authorization after breaching duty of loyalty to employer).

104 United States v. Rodriguez, 628 F.3d 1258, 1263 (11th Cir. 2010) (concluding that defendant exceeded authorized

access by violating employer policy against using employer database for personal purposes).

105 John, 597 F.3d at 272.

106 United States v. Valle, 807 F.3d 508, 523 (2d Cir. 2015) (concluding that an individual does not exceed authorized

access where individual is authorized for certain uses, and surpasses those).

107 WEC Carolina Energy Sols. LLC v. Miller, 687 F.3d 199, 206 (4th Cir. 2012) (“[W]e adopt a narrow reading of the

terms ‘without authorization’ and ‘exceeds authorized access’ and hold that they apply only when an individual

accesses a computer without permission or obtains or alters information on a computer beyond that which he is

authorized to access.”).

108 United States v. Nosal (Nosal I), 676 F.3d 854, 863 (9th Cir. 2012) (“Instead, we hold that the phrase ‘exceeds

authorized access’ in the CFAA does not extend to violations of use restrictions.”).

109 See Valle, 807 F.3d at 528.

110 Nosal I, 676 F.3d at 856–57.

111 Van Buren v. United States, 141 S. Ct. 1648, 1662 (2021).

112 Id. at 1652.

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

opposed to accessing a computer or information that he is entitled to use in at least some

circumstances.113

Damage

The CFAA defines “damage” to mean “impairment to the integrity or availability of data, a

program, a system, or information,”114 which occurs, for example, when a hacker causes a

computer to behave in a manner contrary to the intentions of its owner.115 Thus, an act that causes

damage under the CFAA may include “clearly destructive behavior such as using a virus or worm

or deleting data ... [b]ut it may also include less obviously invasive conduct, such as flooding an

email account.”116 For example, one federal court concluded that damage occurred as a result of

an orchestrated effort to bombard a company’s “sales offices and three of its executives with

thousands of phone calls and e-mails,” which diminished the ability of that company to use their

systems.117

Prohibited Conduct Under the CFAA

The CFAA prohibits seven categories of conduct, ranging from certain acts of computer trespass

to unauthorized computer access with an intent to defraud.118

Cyber Espionage, 18 U.S.C § 1030(a)(1)

Section 1030(a)(1)119 is a cyber-espionage provision that in certain instances prohibits obtaining

and sharing national security information120—such as “information that has been determined by

113 Id. at 1662.

114 18 U.S.C. § 1030(e)(8).

115 See CRS Legal Sidebar LSB10446, An Overview of Federal Criminal Laws Implicated by the COVID-19 Pandemic,

by Peter G. Berris at 2 (explaining that damage “occurs, for example, where a hacker causes a computer to behave in a

manner contrary to the intentions of its owner”); accord United States v. Yücel, 97 F. Supp. 3d 413, 420 (S.D.N.Y.

2015) (construing damage under § 1030(a)(5) to include instances where a computer is caused to “no longer operate[]

only in response to the commands of the owner”); see also United States v. Hutchins, 361 F. Supp. 3d 779, 794 (E.D.

Wis. 2019) (concluding that use of the phrase “malware” in indictment was “sufficient to allege intent to cause

damage” in CFAA prosecution). For a more detailed examination of different examples of damage, see, e.g., KERR,

supra note 12 at 113–15.

116 Hutchins, 361 F. Supp. 3d at 794 (alterations in original) (quoting Fidlar Tech. v. LPS Real Estate Data Sols., Inc.,

810 F.3d 1075, 1084–85 (7th Cir. 2016)).

117 Pulte Homes, Inc. v. Laborers’ Int’l Union of N. Am., 648 F.3d, 295, 299 (6th Cir. 2011).

118 18 U.S.C. § 1030.

119 18 U.S.C. § 1030(a)(1) imposes criminal penalties on:

(a) Whoever-(1) having knowingly accessed a computer without authorization or exceeding authorized access,

and by means of such conduct having obtained information that has been determined by the United

States Government pursuant to an Executive order or statute to require protection against

unauthorized disclosure for reasons of national defense or foreign relations, or any restricted data,

as defined in paragraph y. of section 11 of the Atomic Energy Act of 1954, with reason to believe

that such information so obtained could be used to the injury of the United States, or to the

advantage of any foreign nation willfully communicates, delivers, transmits, or causes to be

communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to

be communicated, delivered, or transmitted the same to any person not entitled to receive it, or

willfully retains the same and fails to deliver it to the officer or employee of the United States

entitled to receive it.

120 Certain elements of a § 1030(a)(1) violation may be found in other federal espionage laws such as the willful

(continued...)

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

the United States Government pursuant to an Executive order or statute to require protection

against unauthorized disclosure for reasons of national defense or foreign relations.... ”121

According to DOJ, examples of national security information under § 1030(a)(1) could include

“classified information obtained from a Department of Defense computer or restricted data

obtained from a Department of Energy computer.”122 In practice, the provision has been rarely

invoked, if at all,123 perhaps because prosecutors may charge offenses involving national security

information under federal espionage statutes that overlap with § 1030(a)(1).124

Prosecutions under § 1030(a)(1) require the government to establish several elements beyond a

reasonable doubt. First, the government would need to prove that the defendant obtained the

national security information by knowingly125 accessing a computer without authorization or in

excess of authorization.126 Section 1030(a)(1) broadly covers all computers, as opposed to just

protected computers127—for example, those exclusively used by financial institutions or

connected to the internet.128 Second, a § 1030(a)(1) violation requires the government to establish

that the defendant had reason to believe that the information could cause “injury to the United

States” or benefit “any foreign nation.”129 There is little case law expounding on this element, but

DOJ has indicated that the element can likely be satisfied where “the national security

information is classified or restricted” and the defendant was aware of that fact.130 Finally, the

government must prove that the defendant “willfully communicate[d], deliver[ed], transmit[ted]

or ... retain[ed]” the national security information, or attempted to do so, or caused the

communication, delivery, or transmission of national security information.131 This element is

broad, and by its own terms includes a range of activities including the failure to return national

disclosure of covered classified information. E.g., 18 U.S.C. §§ 793, 794, 798; see also COMPUT. CRIME & INTELL.

PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 14–16 (comparing § 1030(a)(1) to various espionage

laws).

121 18 U.S.C. § 1030(a)(1).

122 COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 13.

123 See KERR, supra note 12, at 30 (“Although it is the first in the list of § 1030(a) crimes, [§ 1030(a)(1)] appears never

to have been used.”).

124 See, e.g., Press Release, U.S. Dep’t of Just., Defense Department Linguist Charged with Espionage (Mar. 4, 2020),

https://www.justice.gov/opa/pr/defense-department-linguist-charged-espionage (announcing charges against defendant

under espionage statutes rather than § 1030(a)(1) for alleged conduct including improperly accessing United States

Department of Defense “classified systems,” which defendant “had no need to access,” and transmitting that

information to “a foreign terrorist organization”); accord COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S.

DEP’T OF JUST., supra note 12, at 15 (“In situations where both [§ 1030(a)(1) and a federal espionage statute] ... are

applicable, prosecutors may tend towards using [the espionage statutes], for which guidance and precedent are more

prevalent.”).

125 Although the CFAA does not define “knowingly,” and despite a dearth of case law on § 1030(a)(1), a Senate report

accompanying the 1986 amendment to the CFAA noted that a knowing act is one where the person is aware “that the

result is practically certain to follow from his conduct, whatever his desire may be as to that result.” S. REP. NO. 99-432,

at 6 (1986) (quoting United States v. U.S. Gypsum Co., 438 U.S. 422, 445 (1978)). That description tracks judicial

interpretations of the word knowing under other subsections of the CFAA, where courts have concluded that the term

excludes accidental behavior. See QVC, Inc. v. Resultly, LLC, 99 F. Supp. 3d 525, 536 (E.D. Pa. 2015) (concluding

that § 1030(a)(5)(A) requires showing that “defendant intended to cause harm” and that “[d]amage caused by mere

recklessness or negligence is insufficient”).

126 18 U.S.C. § 1030(a)(1).

127 Id.

128 See supra Section “Protected Computers.”

129 18 U.S.C. § 1030(a)(1).

130 U.S. DEP’T OF JUST., supra note footnote 12, at 14.

131 18 U.S.C. § 1030(a)(1).

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

security information or the disclosure of that information.132 However, such behavior must be

intentional.133

Obtaining Information by Unauthorized Computer Access, 18 U.S.C. § 1030(a)(2)

Section 1030(a)(2)134 generally prohibits accessing a computer without authorization or in excess

of authorization and obtaining information in certain circumstances. Although at first glance, it

could appear that to “obtain information” might refer specifically to misappropriation or theft of

information, the concept is much broader.135 As interpreted by courts, “obtaining information”

includes “mere observation of the data” such as looking at or reading information on a screen.136

The government has invoked § 1030(a)(2) in a variety of prosecutions,137 including in the case of

several individuals for “breaking into computer networks of prominent technology companies and

the U.S. Army” and stealing “more than $100 million in intellectual property,”138 two

Massachusetts men for stealing social media accounts and cryptocurrency through unauthorized

computer access,139 and an Italian citizen for “hack[ing] into thousands of computers without

permission [and] ... gaining access to all of the information stored on those computers.”140

There are three additional statutory requirements that the government must satisfy to prove a

§ 1030(a)(2) violation—only one of which seems to limit the provision’s scope in a significant

132 Id.

133 Id.

134 Section 1030(a)(2) imposes criminal liability on:

(a) Whoever-(2) intentionally accesses a computer without authorization or exceeds authorized access, and

thereby obtains-(A) information contained in a financial record of a financial institution, or of a card issuer as

defined in section 1602(n) of title 15, or contained in a file of a consumer reporting agency on a

consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.);

(B) information from any department or agency of the United States; or

135 See United States v. Drew, 259 F.R.D. 449, 457 (C.D. Cal. 2009) (“‘Obtain[ing] information from a computer’ has

been described as ‘includ[ing] mere observation of the data. Actual aspiration ... need not be proved in order to

establish a violation.... ’” (alterations in original) (quoting S. REP. NO. 99-432, at 6–7 (1986))); Am. Online, Inc. v.

Nat’l Health Care Disc., Inc., 121 F. Supp. 2d 1255, 1276 (N.D. Iowa 2000) (relying on legislative history for the

proposition that § 1030(a)(2) covers not just theft but also the observation of data).

136 See Drew, 259 F.R.D. at 457 n.13 (“[T]he term ‘obtaining information’ includes merely reading it.” (alteration in

original) (quoting S. REP. NO. 104–357, at 7 (1996))).

137 Section 1030(a)(2) is “the most commonly charged section of the [CFAA].” KERR, supra note 12, at 79.

138 Press Release, U.S. Dep’t of Just., Four Members of International Computer Hacking Ring Indicted for Stealing

Gaming Technology, Apache Helicopter Training Software (Sept. 30, 2014), https://www.justice.gov/opa/pr/fourmembers-international-computer-hacking-ring-indicted-stealing-gaming-technology-apache; Memorandum of Plea

Agreement, United States v. Leroux, No. 13-78-GMS, 2015 WL 10372423 (D. Del. Jan. 20, 2015) (setting forth plea of

guilty to conspiracy to violate § 1030(a)(2)).

139 Press Release, U.S. Dep’t of Just., Two Massachusetts Men Arrested and Charged with Nationwide Scheme to Steal

Social Media Accounts and Cryptocurrency (Nov. 14, 2019), https://www.justice.gov/opa/pr/two-massachusetts-menarrested-and-charged-nationwide-scheme-steal-social-media-accounts-and; Press Release, U.S. Dep’t of Just.,

Massachusetts Man Pleads Guilty to Operating Nationwide Scheme to Steal Social Media Accounts and

Cryptocurrency (Apr. 28, 2021), https://www.justice.gov/opa/pr/massachusetts-man-pleads-guilty-operatingnationwide-scheme-steal-social-media-accounts-and; Indictment, United States v. Meiggs, No. 19-CR-10438, 2019 WL

12117167 (D. Mass. Nov. 13, 2019).

140 United States v. Gasperini, 894 F.3d 482, 487 (2d Cir. 2018).

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

way.141 First, for § 1030(a)(2) to apply, the information must be obtained from either a financial

institution,142 the federal government, or “any protected computer.”143 As discussed, any computer

connected to the internet suffices. Second, § 1030(a)(2) requires intentional access to a computer

by the defendant, “rather than mistaken, inadvertent, or careless” access.144 However, the intent

requirement is a low bar to prosecution because intent to obtain information is not required;

instead, all that is required is intent to access a computer without authorization or in excess of

authorization.145 Third, the defendant’s access must be without authorization or in excess of

authorization—elements that are discussed above. Before Van Buren, this requirement arguably

did little to limit the expansive scope of § 1030(a)(2), at least in jurisdictions that had adopted a

broad interpretation of the phrase “exceeds authorized access.”146 However, by limiting “exceeds

authorized access” to exclude an individual who uses a computer for an unapproved reason, Van

Buren solidified the element as a more meaningful limit on § 1030(a)(2) prosecutions.147 As

discussed, Van Buren reversed a § 1030(a)(2) conviction on these grounds—concluding that a

police officer who was authorized to access information from a law enforcement database for

official purposes only, did not exceed authorized access in violation of § 1030(a)(2) by accessing

information from that database for other purposes.148

Government Computer Trespassing, 18 U.S.C. § 1030(a)(3)

Section 1030(a)(3)149 generally prohibits intentionally accessing a government computer without

authorization. The provision establishes “a simple trespass offense,”150 which at common law

often refers to an unsanctioned entry onto the land of another, regardless of whether that entry

causes any harm.151 Unlike the previous two CFAA prohibitions, the crux of a § 1030(a)(3)

141 See generally KERR, supra note 12, at 81–82 (explaining breadth of § 1030(a)(2) and why requirements in that

provision pose “relatively low thresholds”).

142 The provision also includes information obtained from card issuers and consumer reporting agencies. 18 U.S.C.

§ 1030(a)(2).

143 18 U.S.C. § 1030(a)(2).

144 S. REP. NO. 99-432, at 5 (1986).

145 United States v. Willis, 476 F.3d 1121, 1125 (10th Cir. 2007) (“A plain reading of the statute reveals that the

requisite intent to prove a violation of § 1030(a)(2)(C) is ... intent to obtain unauthorized access of a protected

computer.... The government need not also prove that the defendant had the intent to defraud in obtaining the

information or that the information was used to any particular ends.”); United States v. Drew, 259 F.R.D. 449, 467

(C.D. Cal. 2009) (“The only scienter element in section 1030(a)(2)(C) is the requirement that the person must

‘intentionally’ access a computer without authorization or ‘intentionally’ exceed authorized access.”).

146 As one court described the pre-Van Buren landscape, barring a narrow interpretation of “without authorization” or

“exceeds authorized access,” it was possible that § 1030(a)(2) could criminalize any conscious violation of ToS or

other contractual restrictions on computer use. Drew, 259 F.R.D. at 457.

147 Van Buren v. United States, 141 S. Ct. 1648, 1662 (2021).

148 Id. at 1652.

149 18 U.S.C. § 1030(a)(3) imposes criminal liability on:

(a) Whoever-(3) intentionally, without authorization to access any nonpublic computer of a department or

agency of the United States, accesses such a computer of that department or agency that is

exclusively for the use of the Government of the United States or, in the case of a computer not

exclusively for such use, is used by or for the Government of the United States and such conduct

affects that use by or for the Government of the United States.

150 S. REP. NO. 99-432, at 7 (1986) (clarifying that § 1030(a)(3) “applies to acts of simple trespass against computers

belonging to, or being used by or for, the Federal Government”).

151 E.g., Restatement (Second) of Torts § 158 (1965). Criminal liability for trespass—under various statutes—often

(continued...)

Congressional Research Service

Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act

violation is unauthorized entry into a government computer, and the provision does not require

that the defendant do anything with, or obtain anything from, the covered computer once he has

accessed it.152 The provision is seldom invoked by prosecutors, possibly because it overlaps

significantly with § 1030(a)(2), which imposes stricter penalties.153

There are two ways the government can establish a § 1030(a)(3) violation.154 First, the

government may demonstrate that the defendant accessed a “nonpublic computer of a department

or agency of the United States” used exclusively by the federal government.155 A nonpublic

computer includes one for internal use, such as the data servers of a federal agency.156 The term

nonpublic computer excludes, however, public-facing government computers, internet servers,

and websites, such as those offering public services or information.157 Second, the government

may establish a § 1030(a)(3) violation where the defendant accesses a “nonpublic computer of a

department or agency of the United States,” if that computer is used in part by the federal

government and the defendant’s “conduct affects that use.”158 A computer used in part by the

federal government might include, for example, a private company’s computer on which the

federal government has an account.159 In practice, “[a]lmost any network intrusion will affect the

government’s use of its computers because any intrusion potentially affects the confidentiality

and integrity of the government’s network and often requires substantial measures to assure the

integrity of data and the security of the network.”160

Regardless of the nature of the § 1030(a)(3) violation, the government must prove that the

defendant’s access was intentional and without authorization.161 The intent requirement is

identical to the one in § 1030(a)(2). Although the meaning of “without authorization” is also

discussed above,162 it is notable that the statute excludes liability where the defendant’s conduct

merely exceeds authorized access.163 Based on legislative history, it appears that such language

involves additional requirements such as notice to a person that he is trespassing, followed by that person’s knowing

refusal to vacate the area in which he is trespassing. E.g., CONN. GEN. STAT. § 53a-107.

152 See COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 23 (“Section

1030(a)(3) protects against ‘trespasses’ by outsiders into federal government computers, even when no information is

obtained during such trespasses.”); S. REP. 99-432 at 7 (1986) (explaining that with amendment, § 1030(a)(3) will

apply “to acts of simple trespass against computers belonging to, or being used by or for, the Federal Government”);