# Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act and Related Statutes > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/crs%3AR47557 ## Record - **Collection:** Congressional research report - **Document type:** CRS Report - **Published:** May 16, 2023 - **Citation:** R47557 ## Text Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act and Related Statutes May 16, 2023 Congressional Research Service https://crsreports.congress.gov R47557 SUMMARY Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act and Related Statutes R47557 May 16, 2023 Peter G. Berris Legislative Attorney There is no single, straightforward definition of cybercrime under federal law. Rather, depending on the context, “cybercrime” may refer to all crimes involving computers, or only to crimes targeting computers, or to crimes unique to the computer context. Regardless, federal prosecutors have a number of statutory tools to charge conduct that fits within these varying conceptualizations of cybercrime. One example of a federal cybercrime provision is the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030—a law prohibiting a variety of computer-related conduct and providing for both civil and criminal penalties. Although sometimes described as an anti-hacking law, the CFAA covers more than just hacking. The statute prohibits seven categories of conduct involving unauthorized access to computers, including, with certain exceptions and conditions: • • • • • Obtaining national security information through unauthorized computer access and sharing or retaining it; • • Trafficking in passwords or other means of unauthorized access to a computer; Obtaining certain types of information through unauthorized computer access; Accessing government computers without authorization; Engaging in computer-based frauds through unauthorized computer access; Knowingly causing damage to certain computers by transmission of a program, information, code, or command; Making extortionate threats to harm a computer or based on information obtained through unauthorized access to a computer. In addition to hacking, some types of cybercrime may include data theft, swatting, doxing, cyberstalking, cyber harassment, unlawful access to electronic communications, or fraud. To the extent that conduct in these categories involves unauthorized computer access, the CFAA may provide a powerful statutory tool to prosecute. Depending on the circumstances, prosecutors may also look to a number of other statutes in their charging decisions. For example, data theft targeting trade secrets may violate the Economic Espionage Act. Cyber harassment and cyberstalking might run afoul of the federal cyberstalking statute (18 U.S.C. § 2261A(2)). Swatting—that is, reporting a false emergency in an attempt to direct an armed police response to a target or location—may violate a federal law proscribing the transmission of certain threats in interstate commerce. When it targets certain federal officials, doxing—obtaining another individual’s personal identifying information (such as an address, telephone number, or Social Security Number) and posting it online for harassment or other purposes—may incur penalties under a federal statute restricting the disclosure of personal information. The unlawful access of communications—such as emails and texts—might potentially violate statutes such as the Wiretap Act. Finally, one frequently used prosecutorial tool relevant to the cybercrime context is the federal wire fraud statute, 18 U.S.C. § 1343, which authorizes criminal penalties for knowing or willing participation in a scheme to defraud using interstate wires. The wire fraud statute provides an additional statutory tool to prosecute some conduct that may also violate the CFAA, and an alternate tool to charge electronic fraud that does not involve unauthorized computer access as required by the CFAA’s cyber-fraud provisions. The ubiquity of computers—and the myriad ways in which they may be used or targeted by criminals—means there is no shortage of cybercrime issues of potential legislative interest to Congress. For example, Congress may wish to consider creating new criminal penalties for conduct like doxing or trafficking in botnets (networks of compromised computers used to perpetrate various cybercrimes). Congress may also be interested in establishing additional penalties for cybercrimes with particular targets such as those impacting critical infrastructure. Alternatively, Congress may seek solutions outside of criminal law to provide for other means of responding to cybercrimes—as in the case of legislative proposals that would explore or facilitate hacking back against cyber attackers. In recent Congresses, Members have introduced proposals on each of these topics. Congressional Research Service Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act Contents Introduction ..................................................................................................................................... 1 The Computer Fraud and Abuse Act ............................................................................................... 3 History of the CFAA ................................................................................................................. 3 Overview of the CFAA ............................................................................................................. 5 Key CFAA Terms ................................................................................................................ 5 Prohibited Conduct Under the CFAA ................................................................................ 11 Remedies and Penalties..................................................................................................... 25 Other Cybercrimes ........................................................................................................................ 29 Data Theft................................................................................................................................ 29 Swatting, Doxing, Cyberstalking, and Cyber Harassment ...................................................... 31 Unlawful Access to Electronic Communications .................................................................... 34 Other Electronic Fraud ............................................................................................................ 36 Challenges in Prosecuting Cybercrimes Originating Abroad ........................................................ 38 Congressional Considerations ....................................................................................................... 40 Botnet Trafficking ................................................................................................................... 40 “Hacking Back” ...................................................................................................................... 44 Critical Infrastructure .............................................................................................................. 46 Doxing and Swatting ............................................................................................................... 48 The Insider Threat ................................................................................................................... 49 Tables Table 1. Overview of CFAA Maximum Penalties ......................................................................... 26 Table 2. Overview of Maximum Penalties Under 18 U.S.C. § 1030(a)(2) ................................... 27 Table 3. Overview of Maximum Penalties Under 18 U.S.C. § 1030(a)(5)(A) .............................. 27 Table 4. Overview of Maximum Penalties Under 18 U.S.C. § 1030(a)(5)(B) .............................. 28 Contacts Author Information........................................................................................................................ 53 Congressional Research Service Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act Introduction Computers are more prevalent than ever before.1 Their ubiquity has made them a favored tool for, and target of, criminals.2 In 2022—the most recent year for which data is available—the FBI’s Internet Crime Complaint Center received 800,944 reported complaints of cybercrime with potential “losses exceeding $10.3 billion.”3 Numerous headline-grabbing incidents further underscore the frequent and evolving connection between computers and crime. For example, in May 2021, a ransomware attack prompted the Colonial Pipeline Company to shut down its network temporarily, impacting gasoline availability and prices4 before the company reportedly paid a ransom of over $4 million worth of Bitcoin.5 In January 2022, the International Committee of the Red Cross announced that cyber attackers had obtained “personal data belonging to more than 515,000 people worldwide” from its systems.6 In March 2022, hackers reportedly stole cryptocurrency valued in the hundreds of millions of dollars from a service called Ronin.7 In December 2022, federal authorities arrested two Queens, New York residents, whom they alleged conspired with Russian hackers to “hack the electronic taxi dispatch system” at John F. Kennedy 1 According to the United States Census Bureau (Census Bureau), by one measure, only 8% of households had a computer in 1984. MICHAEL MARTIN, U.S. CENSUS BUREAU, COMPUTER AND INTERNET USE IN THE UNITED STATES: 2018, at 4 (2021), https://www.census.gov/content/dam/Census/library/publications/2021/acs/acs-49.pdf. According to the same report, 92% of households had a computer in 2018. Id. The prevalence of computers may also be inferred from the estimated number of computerized devices such as smart appliances and fitness trackers connected to the Internet of Things (IoT)—by one account, there will be 21.5 billion such active devices connected to the IoT by 2025. CRS In Focus IF11239, The Internet of Things (IoT): An Overview, by Patricia Moloney Figliola. For a review of Computer Fraud and Abuse Act (CFAA) issues unique to the IoT, see generally Sara Sun Beale & Peter Berris, Hacking the Internet of Things: Vulnerabilities, Dangers, and Legal Responses, 16 DUKE L. & TECH. REV. 161, 162 (2018). As discussed below, these devices are considered computers in the context of the CFAA. See infra Section “Protected Computers.” 2 See, e.g., Oversight of the Federal Bureau of Investigation: Hearing Before the S. Comm. on the Judiciary, 117th Cong. 5–9 (2022) (statement of Christopher A. Wray, Director, Fed. Bureau of Investigation) (discussing nature of current cyber threats). 3 FED. BUREAU OF INVESTIGATION, INTERNET CRIME REPORT 2022, at 7 (2023), https://www.ic3.gov/Media/PDF/AnnualReport/2022_IC3Report.pdf; see also, Press Release, Fed. Bureau of Investigation Springfield, Internet Crime Complaint Center Releases 2022 Statistics (Mar. 22, 2023), https://www.fbi.gov/contact-us/field-offices/springfield/news/internet-crime-complaint-center-releases-2022-statistics. 4 CRS Insight IN11667, Colonial Pipeline: The DarkSide Strikes, by Paul W. Parfomak and Chris Jaikaran; see generally Stephanie Kelly & Laura Sanicola, U.S. Capital Running Out of Gas, Even as Colonial Pipeline Recovers, REUTERS (May 14, 2021), https://www.reuters.com/business/energy/colonial-pipeline-ramps-up-us-seeks-emerge-fuelcrunch-2021-05-14/; Brett Molina & Nathan Bomey, Colonial Pipeline Restarted Operations, Owners Say “It Will Take Several Days” For Supply Chain to Return to Normal, USA TODAY (May 12, 2021), https://www.usatoday.com/story/money/2021/05/12/gas-shortage-gas-prices-colonial-pipeline-nc-virginia-northcarolina/5052551001/; Catherine Thorbecke, Gas Hits Highest Price in 6 Years, Fuel Outages Persist Despite Colonial Pipeline Restart, ABC NEWS (May 17, 2021), https://abcnews.go.com/US/gas-hits-highest-price-years-fuel-outagespersist/story?id=77735010. 5 Cathy Bussewitz, Colonial Pipeline Confirms It Paid $4.4M to Hackers, AP NEWS (May 19, 2021), https://apnews.com/article/hacking-technology-business-ed1556556c7af6220e6990978ab4f745. 6 Cyber-attack on ICRC: What we Know, INT’L COMM. OF THE RED CROSS (Feb. 16, 2022), https://www.icrc.org/en/document/cyber-attack-icrc-what-we-know. 7 Rob Lever, Data Breaches in 2022, U.S. NEWS & WORLD REPORT (Oct. 28, 2022), https://www.usnews.com/360reviews/privacy/recent-data-breaches; Tom Wilson & Elizabeth Howcroft, Blockchain Project Ronin Hit by $615 Million Crypto Heist, REUTERS (Mar. 29, 2022), https://www.reuters.com/technology/blockchain-company-ronin-hitby-615-million-crypto-heist-2022-03-29/. Congressional Research Service 1 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act International Airport and used their unauthorized access to charge drivers a fee to skip the taxi queue.8 The world of computer-based crime extends beyond financially motivated hacking. Examples abound of criminals using computers and the internet to threaten9 and stalk,10 among other things. Conceptually, the true scope of cybercrime or computer crime depends in part on definitions.11 Depending on the context, “cybercrime” might refer specifically to crimes requiring the use of a computer, such as hacking, or to traditional crimes when they involve use of a computer or the internet, like harassment.12 This report uses the term cybercrime somewhat broadly to include both crimes unique to the computer context and some traditional crimes that may be committed using computers.13 The report focuses mainly on the Computer Fraud and Abuse Act (CFAA)—a primary tool in prosecuting cybercrimes like hacking and ransomware attacks at the federal level.14 The report discusses key CFAA terms and summarizes its substantive prohibitions, then provides an overview of remedies and penalties under the statute. Many cybercrimes may implicate federal statutes other than, or in addition to, the CFAA.15 Thus, the report briefly discusses some of these crimes, such as cyberstalking, and identifies statutes that may be used to 8 Indictment, United States v. Abayev, No. 22 Crim. 655 (S.D.N.Y. Dec. 5, 2022); Press Release, U.S. Dep’t of Just., Two Men Arrested For Conspiring With Russian Nationals To Hack The Taxi Dispatch System At JFK Airport (Dec. 20, 2022), https://www.justice.gov/usao-sdny/pr/two-men-arrested-conspiring-russian-nationals-hack-taxidispatch-system-jfk-airport. 9 E.g., Press Release, U.S. Dep’t of Just., Connecticut Man Pleads Guilty to Cyberstalking and Threatening Massachusetts Woman (Sep. 7, 2022), https://www.justice.gov/usao-ma/pr/connecticut-man-pleads-guiltycyberstalking-and-threatening-massachusetts-woman; Press Release, U.S. Dep’t of Just., Man Arrested for Making Threats of Violence Against FBI (Aug. 15, 2022), https://www.justice.gov/opa/pr/man-arrested-making-threatsviolence-against-fbi; Press Release, U.S. Dep’t of Just., New Jersey Man Pleads Guilty to Threatening Employees of Latino Civil Rights Organizations (Oct. 20, 2010), https://www.justice.gov/opa/pr/new-jersey-man-pleads-guiltythreatening-employees-latino-civil-rights-organizations. 10 E.g., Press Release, U.S. Dep’t of Just., Two Former eBay Employees Sentenced for Aggressive Cyberstalking Campaign (Oct. 11, 2022), https://www.justice.gov/usao-ma/pr/two-former-ebay-employees-sentenced-aggressivecyberstalking-campaign; Press Release, U.S. Dep’t of Just., Deputy U.S. Marshal Charged with Cyberstalking and Perjury (Mar. 14, 2021), https://www.justice.gov/opa/pr/deputy-us-marshal-charged-cyberstalking-and-perjury; Press Release, U.S. Dep’t of Just., Florida Man Sentenced for Racially-Motivated Interference with Election in Charlottesville, Virginia and for Cyberstalking in Florida (Aug. 31, 2020), https://www.justice.gov/opa/pr/florida-mansentenced-racially-motivated-interference-election-charlottesville-virginia-and. 11 This report uses the phrases cybercrime and computer crime interchangeably. 12 See, e.g., ORIN S. KERR, COMPUTER CRIME LAW 1 (5th ed. 2022) (“Substantive computer crime law divides into two basic categories: computer misuse crimes and traditional crimes.”); COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., PROSECUTING COMPUTER CRIMES (2015), https://www.justice.gov/sites/default/files/criminalccips/legacy/2015/01/14/ccmanual.pdf (defining computer crime, cybercrime, and network crime in relation to “ those crimes that use or target computer networks”); Crime, BLACK'S LAW DICTIONARY (11th ed. 2019) (defining computer crime as “[a] crime involving the use of a computer, such as sabotaging or stealing electronically stored data”); Cybercrime, NEW OXFORD AMERICAN DICTIONARY (1st ed. 2005) (defining cybercrime as “crime conducted via the Internet or some other computer network”); Cybercrime, BRITANNICA (2022), https://www.britannica.com/topic/cybercrime (defining cybercrime, “also called computer crime,” as “the use of a computer as an instrument to further illegal ends, such as committing fraud, trafficking in child pornography and intellectual property, stealing identities, or violating privacy”). 13 For further discussion of how to conceptualize cybercrime, see generally KERR, supra note 12, at 1–3. 14 See U.S. DEP’T OF JUST., JUSTICE MANUAL § 9-48.000 (2022), https://www.justice.gov/jm/jm-9-48000-computerfraud (describing importance of CFAA in “address[ing] cyber-based crimes”). 15 Given the large number of federal criminal provisions, it is not possible to provide a comprehensive overview of federal laws that may apply to every example of crime involving computers. See, e.g., Van Buren v. United States, 141 S. Ct. 1648, 1669 (2021) (Thomas, J., dissenting) (“The number of federal laws and regulations that trigger criminal penalties may be as high as several hundred thousand.”). Congressional Research Service 2 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act prosecute them at the federal level. The report concludes with a discussion of congressional considerations. The Computer Fraud and Abuse Act Congress was prescient about the ubiquity of cybercrime nearly 40 years ago when it enacted the CFAA—a civil16 and criminal law that prohibits a range of computer-based acts.17 While a number of federal statutes may be relevant to combatting nefarious computer activities such as those discussed above,18 the CFAA is perhaps the most relevant.19Among other things, the CFAA prohibits a person from trespassing into, damaging, or acquiring information from certain categories of computers, assuming the user lacks authorization for that conduct.20 Prosecutors invoke the CFAA to combat a variety of malign computer-based activities.21 History of the CFAA By many accounts, the history of the CFAA begins with a movie—the 1983 thriller WarGames22 starring Matthew Broderick.23 In WarGames, Broderick’s character, a rebellious high school student, nearly starts World War III when he accidentally accesses the computer system controlling the United States nuclear arsenal, mistaking the system for an interactive video game.24 The movie’s depiction of the dangers of the computer age—where even nuclear annihilation could be a few keystrokes away—was not lost on policy makers.25 According to one 16 This report cites to civil CFAA opinions despite focusing on cybercrime, as “most of the published cases interpreting § 1030 arise in the civil context rather than the criminal context.” KERR, supra note 12, at 31. Further, courts “must interpret the statute consistently, whether [they] encounter its application in a criminal or noncriminal context.” hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1200 (9th Cir. 2022) (quoting Leocal v. Ashcroft, 543 U.S. 1, 12 n.8, (2004); see also ORIN S. KERR, COMPUTER CRIME LAW 75 (3d ed. 2013) (“Courts generally use civil and criminal interpretations of federal statutes interchangeably absent an indication that Congress intended a contrary approach.”). 17 H.R. REP. NO. 98-894, at 10 (1984) (“[B]y combining the ubiquity of the telephone with the capability of the personal computer, a whole new dimension of criminal activity becomes possible.”). 18 For example, relevant provisions might include, among others, federal laws criminalizing wire fraud under 18 U.S.C. § 1343, cyberstalking under 18 U.S.C. § 2261A, the interception of electronic communications under 18 U.S.C. § 2511, or the unlawful access of stored communications under 18 U.S.C. § 2701. See infra “Other Cybercrimes.” 19 See, e.g., John P. Carlin, Detect, Disrupt, Deter: A Whole-of-Government Approach to National Security Cyber Threats, 7 HARV. NAT'L SEC. J. 391, 418–19 (2016) (describing the CFAA as a “cornerstone” statute and the “most important” of the “wide array of statutes that address the full life cycle of a national security cyber threat”); Michael L. Rustad, Private Enforcement of Cybercrime on the Electronic Frontier, 11 S. CAL. INTERDISC. L.J. 63, 89 (2001) (naming the CFAA as “the single most important federal statute governing computer crime”). 20 18 U.S.C. § 1030. 21 See infra Section “Prohibited Conduct Under the CFAA.” 22 WARGAMES (Metro-Goldwyn-Mayer Studios 1983). 23 See Fred Kaplan, ‘WarGames’ and Cybersecurity’s Debt to a Hollywood Hack, N.Y. TIMES (Feb. 19, 2016), https://www.nytimes.com/2016/02/21/movies/wargames-and-cybersecuritys-debt-to-a-hollywood-hack.html (describing the birth of federal cybersecurity laws following President Ronald Reagan’s concern over the movie); Ivan Evtimov, et al., Is Tricking A Robot Hacking?, 34 BERKELEY TECH. L.J. 891, 904 (2019) (“According to popular lore, President Reagan saw the movie War Games and met with his national security advisers the next day to discuss America’s cyber vulnerabilities. The CFAA is said to be the result of their deliberations.”); Jay P. Kesan & Carol M. Hayes, Mitigative Counterstriking: Self-Defense and Deterrence in Cyberspace, 25 HARV. J.L. & TECH. 429, 492 (2012) (“There is some evidence that when the CFAA was originally enacted in 1984, it was partially in response to the situations depicted in the action film WarGames.”). 24 See Roger Ebert, WarGames, ROGEREBERT.COM (June 3, 1983), https://www.rogerebert.com/reviews/wargames1983 (reviewing and summarizing plot of WarGames). 25 H.R. REP. NO. 98-894, at 10 (1984) (referencing WarGames in discussion of necessity of computer fraud legislation). Congressional Research Service 3 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act report, after viewing WarGames at Camp David, President Ronald Reagan asked advisers and the chairman of the Joint Chiefs of Staff whether the plot of the movie was possible.26 The CFAA is sometimes “said to be the [eventual] result of their deliberations,”27 although congressional interest in computer crimes may be traced back at least as far as the 1970s.28 The first major federal computer-crime enactment came in the form of the Counterfeit Access Device and Computer Fraud and Abuse Act of 1984 (the 1984 Act).29 With exceptions, the law prohibited three subsets of computer-based conduct: (1) obtaining national security information through unauthorized computer access; (2) obtaining financial information through unauthorized computer access; and (3) trespassing into a government computer and “knowingly us[ing], modif[ying], destroy[ing], or disclos[ing] information” on that computer.30 The 1984 Act was relatively narrow,31 and the Department of Justice (DOJ) expressed concern that it made computer crime prosecutions difficult.32 In 1986, Congress substantially amended the 1984 Act, and the modern CFAA has many of its roots in that 1986 amendment.33 Among other things, the 1986 amendment modified intent requirements and prohibited new categories of conduct including password trafficking, damaging computers, and accessing computers with intent to defraud.34 Since 1986, Congress has amended the CFAA on numerous occasions,35 broadening both the scope of conduct prohibited by the statute and the scope of computers protected.36 Today, the CFAA is the main federal37 computer misuse statute.38 26 Kaplan, supra note 23. 27 Evtimov, supra note 23, at 904. 28 E.g., S. COMM. ON GOV’T OPERATIONS, 94TH CONG., PROBLEMS ASSOCIATED WITH COMPUTER TECHNOLOGY IN FEDERAL PROGRAMS AND PRIVATE INDUSTRY—COMPUTER ABUSES (Comm. Print 1976). 29 See WEC Carolina Energy Sols. LLC v. Miller, 687 F.3d 199, 201 (4th Cir. 2012) (“In 1984, Congress initiated a campaign against computer crime by passing the Counterfeit Access Device and Computer Fraud and Abuse Act of 1984.”); Orin S. Kerr, Cybercrime’s Scope: Interpreting “Access” and “Authorization” in Computer Misuse Statutes, 78 N.Y.U. L. REV. 1596, 1615 (2003) (“Congress enacted the first federal computer crime law in 1984.”). 30 P.L. 98-473, § 2102, 98 Stat. 1837 (1984) (codified at 18 U.S.C. § 1030). 31 For instance, the 1984 Act “was limited to a narrow range of computers—namely, those containing national security information or financial data and those operated by or on behalf of the government.” hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1197 (9th Cir. 2022). 32 See S. REP. NO. 99-432, at 6–9 (1986) (summarizing concerns expressed by DOJ). 33 Kerr, supra note 29, at 1598 n.11, 1615. 34 Computer Fraud and Abuse Act of 1986, P.L. 99-474, 100 Stat. 1213 (codified as amended at 18 U.S.C. § 1030). 35 E.g., Anti-Drug Abuse Act of 1988, P.L. 100-690, 102 Stat. 4181; Financial Institutions Reform, Recovery, and Enforcement Act of 1989, P.L. 101-73, 103 Stat. 183; Crime Control Act of 1990, Pub. L. No. 101–647, 104 Stat. 4789; Violent Crime Control Act of 1994, Pub. L. No. 103–322, 108 Stat. 1796 ; Economic Espionage Act of 1996, Pub. L. No. 104–294, 110 Stat. 3488; Uniting and Strengthening America by Providing Appropriate Tools Required To Intercept and Obstruct Terrorism (USA PATRIOT ACT) Act of 2001, Pub. L. No. 107–56,115 Stat. 272; 21st Century Department of Justice Appropriations Authorization Act, Pub. L. No. 107-273, 116 Stat. 1758 (2002); Homeland Security Act of 2002, Pub. L. No. 107-296, 116 Stat. 2135; Former Vice President Protection Act of 2008, Pub. L. No. 110-326, 122 Stat. 3560. 36 See COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 1–2. 37 The CFAA exists against the backdrop of numerous state computer crime laws that are beyond the scope of this report. E.g., VT. STAT. ANN. tit. 13, §§ 4101–07 (1999). Computer misuse statutes have been enacted in “all fifty states.... ” KERR, supra note 12, at 29; accord Computer Crime Statutes, NAT’L CONF. OF STATE LEGISLATURES (Feb. 24, 2020), https://www.ncsl.org/research/telecommunications-and-information-technology/computer-hacking-andunauthorized-access-laws.aspx (surveying computer crime laws of all 50 states). 38 See KERR, supra note 12, at 30 (describing CFAA as “the federal computer misuse statute”); see also Evtimov, supra note 23, at 904 (“Since its implementation, the CFAA has been the nation’s predominant anti-hacking law.”). Congressional Research Service 4 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act Overview of the CFAA Key CFAA Terms Although prosecutors may use the CFAA to charge hacking,39 and courts and observers have described the CFAA as an anti-hacking statute,40 the word “hacking” does not appear in any of its various provisions.41 Instead, the statute criminalizes several categories of conduct that include many types of computer hacking as well as a variety of other computer-based activities.42 Generally, the CFAA prohibits certain conduct that is carried out by an individual “without authorization” or who “exceeds authorized access,” and that involves a computer or a “protected computer.”43 Two criminal provisions impose liability for conduct relating to “damage” to a computer.44 Thus, the scope of the CFAA turns largely on the meaning of these terms, which are discussed below. Computer The CFAA broadly45 defines “computer” as any “electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions,” including “any data storage facility or communications facility directly related to or operating in conjunction with such device.... ”46 The CFAA excludes only automated typewriters, typesetters, portable hand held calculators, and similar devices from its definition of computer.47 These limited exceptions “show just how general” the statute’s definition of computer is.48 As one court explained, the definition includes any device with an electronic data processor, of which there are numerous examples.49 Thus, under the CFAA, computers include not only laptops and desktops, but also a wide array of computerized devices ranging from cellphones to objects embedded with microchips, such as certain microwave ovens, watches, and televisions.50 Protected Computers Several provisions of the CFAA specifically concern “protected computers.”51 Among other things, the CFAA defines protected computers as those that are either “exclusively for the use of a 39 See infra Section “Prohibited Conduct Under the CFAA.” 40 E.g., United States v. Nosal (Nosal I), 676 F.3d 854, 857 (9th Cir. 2012); Evtimov, supra note 23, at 904. 41 See 18 U.S.C. § 1030 (proscribing various conduct without use of the word “hacking”). 42 Id. 43 See, e.g., id. § 1030(a)(2) (prohibiting “intentionally access[ing] a computer without authorization” or in excess of authorization, and obtaining certain types of information, including from a “protected computer” (emphasis added)). 44 Id. § 1030(a)(5), (a)(7). 45 See United States v. Mitra, 405 F.3d 492, 495 (7th Cir. 2005) (discussing breadth of CFAA with respect to the types of computers it governs). 46 18 U.S.C. § 1030(e)(1). 47 Id. 48 Mitra, 405 F.3d at 495 (emphasis omitted). 49 United States v. Kramer, 631 F.3d 900, 902 (8th Cir. 2011). 50 Id. at 902–03; accord United States v. Nosal (Nosal II), 844 F.3d 1024, 1050 (9th Cir. 2016) (Reinhardt, J., dissenting) (“This means that nearly all desktops, laptops, servers, smart-phones, as well as any ‘iPad, Kindle, Nook, X–box, Blu–Ray player or any other Internet-enabled device,’ including even some thermostats qualify as [protected computers].” (quoting United States v. Nosal (Nosal I), 676 F.3d 854, 861 (9th Cir. 2012))). 51 18 U.S.C. § 1030. Congressional Research Service 5 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act financial institution or the United States Government” or that are “used in or affecting interstate or foreign commerce or communication.... ”52 Courts have construed the latter phrase to include any computer connected to the internet.53 Thus, most modern computing devices are subject to the CFAA’s protections, including devices such as smart appliances and fitness trackers connected to the Internet of Things54—“a system of interrelated devices connected to a network and/or to one another, exchanging data without necessarily requiring human-to-machine interaction.”55 Another important type of computer that fits within the definition of protected computer is a server—a computer that manages website data and other information.56 For example, one court concluded that the web servers storing and sharing the member data of a large social media website qualified as protected computers.57 Without Authorization and Exceeds Authorized Access The CFAA applies only if the defendant acts “without authorization” or “exceeds authorized access.”58 For example, Section 1030(a)(2) prohibits intentionally accessing a computer without authorization or in excess of authorization and obtaining information from a financial institution, the federal government, or a protected computer.59 Other provisions contain nearly identical requirements.60 52 Id. § 1030(e)(2). A 2020 amendment to the CFAA expanded the definition of “protected computer” to include any computer that “is part of a voting system; and ... is used for the management, support, or administration of a Federal election; or ... has moved in or otherwise affects interstate or foreign commerce.” Defending the Integrity of Voting Systems Act, Pub. L. 116-179, 134 Stat. 855 (2020) (codified in relevant part at 18 U.S.C. § 1030(e)(2)(C)). 53 See, e.g., Van Buren v. United States, 141 S. Ct. 1648, 1652 (2021) (interpreting the definition of protected computer in the context of one subsection of the CFAA to include “all computers that connect to the Internet”); hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1195 (9th Cir. 2022) (“The term ‘protected computer’ refers to any computer ‘used in or affecting interstate or foreign commerce or communication[]’—effectively any computer connected to the Internet.” (quoting 18 U.S.C. § 1030(e)(2)(B)) (internal citations omitted)). 54 Although federal cases specifically examining the CFAA’s applicability in the context of the Internet of Things are scarce, a number of observers have concluded that internet-enabled objects qualify as protected computers. Orin S. Kerr, Vagueness Challenges to the Computer Fraud and Abuse Act, 94 MINN. L. REV. 1561, 1577–78 (2010); accord Beale & Berris, supra note 1, at 170. In one case, federal prosecutors used the CFAA to charge defendants who allegedly gained unauthorized access to Ring smart devices. Indictment, United States v. Nelson and McCarthy, No. 2:22-cr-00598-JAK (C.D. Cal. Dec. 16, 2022). Another example from case law is United States v. Peterson. 776 F. App’x 533 (9th Cir. 2019). In Peterson, the U.S. Court of Appeals for the Ninth Circuit considered a vagueness challenge to a condition of supervised release imposed on a defendant convicted of possessing child pornography. Id. at 533. The condition at issue restricted the defendant from accessing a computer as defined by the CFAA. Id. at 534. In agreeing with the defendant that the condition was potentially overbroad, the court observed that a wide range of objects fall within the definition of computer under the CFAA, including “refrigerators with Internet connectivity, Fitbit™ watches” and certain automobiles. Id. at 535 n.3. Although the court did not discuss these devices in relation to the phrase “protected computer,” it described them in a manner that would satisfy the definition of protected computer under the CFAA; as the court indicated, Internet of Things devices are (1) computers (2) connected to the internet. Id. at 534. For a similar example, see United States v. Wells, 29 F.4th 580, 588 (9th Cir. 2022), cert. denied, 143 S. Ct. 267 (2022). 55 CRS In Focus IF11239, The Internet of Things (IoT): An Overview, by Patricia Moloney Figliola. 56 hiQ Labs, 31 F.4th at 1195. 57 Id. 58 18 U.S.C. § 1030. 59 Id. § 1030(a)(2). 60 See generally id. § 1030. Congressional Research Service 6 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act While the CFAA repeatedly uses the phrases “exceeds authorized access” and “without authorization,” the statute does not fully define either phrase.61 In fact, the statute offers no definition for “without authorization.”62 The CFAA does explain that “exceeds authorized access” means “access[ing] a computer with authorization and us[ing] such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter,” but that definition hinges on the meaning of the undefined phrase “with authorization.”63 On a more fundamental level, the meaning of authorization—the common concept in “exceeds authorized access” and “without authorization”—is also undefined by the CFAA.64 As a result, case law is still developing with respect to what it means to be an authorized computer user. In hiQ Labs, Inc. v. LinkedIn Corp., the Ninth Circuit65 suggested that authorization depends on the computer systems at issue and described three categories.66 The first category encompasses computers where authorization is not required for access in the first place.67 For example, the Ninth Circuit said that computers that are “open to the general public” to access fall in this category.68 The category potentially includes servers for publicly accessible websites, since a “defining feature of public websites is that their publicly available sections lack limitations on access; instead, those sections are open to anyone with a web browser.”69 The second category is comprised of computers “for which authorization is required and has been given.”70 This category might include, for example, scenarios where an employer provides an employee with password credentials to enter a company computer.71 Third, there are computers or areas of computer systems “for which authorization is required but has not been given.”72 The third category poses a crucial question: in what way must the owner of a computer restrict access so that authorization is not given?73 Federal case law on this question is unresolved. In the 2021 opinion Van Buren v. United States, which marked the Supreme Court’s first significant foray into the CFAA, the Court described limits on authorization as “gates.”74 The Van Buren Court explained that assessing authorization under the CFAA is “a gates-up-or-down inquiry” where “one either can or cannot access a computer system, and one either can or cannot access certain areas within the system.”75 Van Buren did not define “gate” but seemed to assume that 61 Id. 62 Id. § 1030(e). 63 Id. (emphasis added). 64 Id. § 1030. 65 This report references a significant number of decisions by federal appellate courts of various regional circuits. For purposes of brevity, references to a particular circuit in the body of this report (e.g., the Ninth Circuit) refer to the U.S. Court of Appeals for that particular circuit. 66 31 F.4th 1180, 1197–98 (9th Cir. 2022). 67 Id. 68 Id. 69 Id. at 1199. 70 Id. at 1198. 71 A number of CFAA cases involve authorization to access computers by virtue of employment and more specifically address what happens to that authorization when the employment ends. E.g., United States v. Nosal (Nosal II), 844 F.3d, 1024, 1038 (9th Cir. 2016). 72 hiQ Labs, 31 F.4th at 1198. 73 See generally Patricia L. Bellia, A Code-Based Approach to Unauthorized Access Under the Computer Fraud and Abuse Act, 84 GEO. WASH. L. REV. 1442, 1444–60 (2016) (discussing five paradigms for conceptualizing the limits of authorization). 74 Van Buren v. United States, 141 S. Ct. 1648, 1658 (2021). 75 Id. at 1658–59. Congressional Research Service 7 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act technological limitations76 such as password requirements constitute a “gate” or limitation on access.77 In a footnote, however, Van Buren left open the possibility that other gates may exist as well, including “limits contained in contracts or policies.”78 Beyond this discussion, the Court left uncertainty as to what means may be used to limit authorization for CFAA purposes.79 In other words, an unresolved question is what “gates” effectively limit a user’s authorization.80 However, in many respects, Van Buren appears to foreclose imposing CFAA liability for mere violations of Terms of Service agreements (ToS)—contractual restrictions on computer use.81 The Van Buren Court held that the CFAA does not criminalize accessing computers for unauthorized purposes.82 Thus, to the extent a contractual restriction such as a ToS limits the purposes for which an individual may access information on a computer—such as an employer policy limiting access to a system for business purposes—violating such restrictions would not incur CFAA liability under Van Buren.83 Delineating the concept of authorization, and its limits, requires reference to the statutory phrases “exceeds authorized access” and “without authorization,” which describe when an individual lacks authorization for CFAA purposes.84 Both phrases are discussed below. Without Authorization: As noted, the CFAA offers no definition for “without authorization.”85 However, at least in theory, Congress seemingly intended for “without authorization” to apply to outsiders such as hackers,86 who are “wholly lacking in authority to access or use [the relevant] computer.”87 Federal courts have generally interpreted “without authorization” to refer to 76 Some observers use the term “code-based” to describe technological limitations, e.g., Bellia supra, note 73, 1457, but the Court has used the phrases “code-based” and “technological” interchangeably with respect to limitations on authorization. Van Buren, 141 S. Ct. at 1659 n.8. 77 It questioned only whether other types of gates beyond technological limitations may also exist. See Van Buren, 141 S. Ct. at 1659 n.8 (“For present purposes, we need not address whether this inquiry turns only on technological (or ‘code-based’) limitations on access, or instead also looks to limits contained in contracts or policies.” (emphasis added)). 78 Id. 79 Id. 80 Id. 81 Even before Van Buren, some federal courts had concluded that the void-for-vagueness doctrine potentially limited CFAA prosecution for mere terms of service violations. See generally, e.g., United States v. Drew, 259 F.R.D. 449, 467 (C.D. Cal. 2009). Also prior to Van Buren, there was an unresolved circuit split over whether the CFAA could impose criminal liability for ToS violations, as a result of conflicting interpretations of the breadth of the phrases “without authorization” and “exceeds authorized access.” Compare, e.g., EF Cultural Travel BV v. Zefer Corp., 318 F.3d 58, 62 (1st Cir. 2003) (“A lack of authorization could be established by an explicit statement on the website restricting access.”) with, e.g., United States v. Nosal (Nosal I), 676 F.3d 854, 863 (9th Cir. 2012) (“Instead, we hold that the phrase ‘exceeds authorized access’ in the CFAA does not extend to violations of use restrictions.”). 82 Van Buren, 141 S. Ct. at 1662. 83 Id. 84 See, e.g., hiQ Labs v. LinkedIn Corp., 938 F.3d 985, 1003 (9th Cir. 2019), aff’d, 31 F.4th 1180 (9th Cir. 2022) (exploring limits of authorization based on whether use of a computer fell into the “without authorization” category as a result of a cease and desist letter). 85 Id. § 1030(e). 86 S. REP. No. 104-357, at 9 (1996) (describing “outsiders” as those “who gain access to a computer without authorization”). 87 S. REP. No. 99-432, at 8 (1986). Congressional Research Service 8 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act outsiders,88 and the Supreme Court appears to have approved of that conclusion in its 2021 opinion in Van Buren v. United States.89 Following Van Buren, a number of federal courts have examined what “gates” may cause someone to be without authorization to access a computer. In hiQ Labs, Inc. v. LinkedIn Corp., the Ninth Circuit concluded that “the CFAA’s prohibition on accessing a computer ‘without authorization’ is violated when a person circumvents a computer’s generally applicable rules regarding access permissions, such as username and password requirements, to gain access to a computer.”90 Thus, the Ninth Circuit held that an entity was not without authorization in violation of the CFAA when it scraped data from a publicly-accessible website despite a cease and desist letter.91 The court further held that “the concept of ‘without authorization’ does not apply to public websites” in general.92 Using Van Buren’s “gates” metaphor for limits on authorization, the Ninth Circuit explained that with respect to a “computer hosting publicly available webpages, that computer has erected no gates to lift or lower in the first place.”93 According to the Ninth Circuit, “[w]ith regard to websites made freely accessible on the Internet . . . the concept of ‘without authorization’ is inapt.”94 Some federal district courts appear to have embraced a less restrictive interpretation of “without authorization” than the Ninth Circuit.95 For instance, one court examined Van Buren and rejected the assertion that “hacking a password is the only way that one can obtain access ‘without authorization.’”96 That court concluded that a reasonable jury could determine that an individual is “without authorization” when he accesses a webpage that is not password protected, but that he believes was intended to be “password protected based on the obviously sensitive nature of the information” on the page, and when he gained access by “guessing their likely URLs.”97 In an unpublished opinion, one federal district court also concluded that an individual can be without authorization if he accessed a computer in violation of ToS and multiple cease and desist letters.98 Subsequent to Van Buren, at least one federal district court has concluded that termination of 88 See, e.g., Sandvig v. Barr, 451 F. Supp. 3d 73, 86 (D.D.C. 2020) (collecting case law concluding that “without authorization” encompasses individuals lacking any approval to access a computer, such as outside hackers); Pulte Homes, Inc. v. Laborers’ Int’l Union of N. Am., 648 F.3d 295, 304 (6th Cir. 2011) (“[A] person who uses a computer ‘without authorization’ has no rights, limited or otherwise, to access the computer in question.” (quoting LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1133 (9th Cir. 2009)) (emphasis omitted)). 89 141 S. Ct. 1648, 1658 (2021) (indicating that a view of “without authorization” that “protects computers themselves by targeting so-called outside hackers” lacking any permission to access a computer “makes sense”); see also United States v. Eddings, No. 5:19-CR-00535, 2021 WL 2527966, at *4 (E.D. Pa. June 21, 2021) (characterizing Van Buren as agreeing that “without authorization” protects computers from outside hackers). 90 31 F.4th 1180, 1201 (9th Cir. 2022). 91 Id. 92 Id. at 1199. 93 Id. 94 Id. at 1198. 95 But see, e.g., Meta Platforms, Inc. v. BrandTotal Ltd., 605 F. Supp. 3d 1218, 1262 (N.D. Cal 2022) (quoting hiQ Labs and holding that “where a website is made available to the public without any authentication requirement in at least the first instance,” the phrase “without authorization” is inapplicable, “even if the owner employs technological measures to block specific users, suspicious activity, or—as here—repeated access beyond a particular threshold”). 96 Vox Mktg. Grp. v. Prodigy Promos, 556 F. Supp. 3d 1280, 1285 (D. Utah 2021) 97 Id. at 1287. 98 ACI Payments, Inc. v. Conservice, LLC, No. 1:21-CV-00084-RJS-CMR, 2022 WL 622214, at *9 (D. Utah Mar. 3, 2022). Congressional Research Service 9 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act employment may revoke authorization and leave the former employee without authorization to access a computer previously accessed by virtue of that employment.99 Exceeds Authorized Access: The meaning of the phrase “exceeds authorized access” long divided federal courts.100 Prior to Van Buren, some federal appellate courts, including the First,101 Fifth,102 Seventh,103 and Eleventh104 Circuits, had adopted a broad view of the CFAA where “the concept of ‘exceeds authorized access’ may include exceeding the purposes for which access is ‘authorized.’”105 In contrast, several other courts, including the Second,106 Fourth,107 and Ninth108 Circuits, had more narrowly interpreted “exceeds authorized access,” based on an understanding that the CFAA’s central purpose is to criminalize hacking. These courts applied CFAA liability only to those who lacked any authorization to access a computer or website109 or who were “authorized to access only certain data or files” but accessed “unauthorized data or files.”110 In Van Buren, the Court appears to have interpreted the CFAA’s scope in a manner roughly consistent with courts that had applied a narrow interpretation of the statute—reading “exceeds authorized access” to exclude an individual who uses a computer for an inappropriate reason.111 The Van Buren court concluded that a police officer did not exceed authorized access when he used a law enforcement database, which he was authorized to use “only for law enforcement purposes,” to search for license plate information for personal profit.112 Thus, pursuant to Van Buren, in order to “exceed authorized access” in violation of the CFAA, an individual must access an area of a computer or information on a computer that is completely “off limits to him,” as 99 See Zap Cellular, Inc. v. Weintraub, No. 15-CV-6723-PKC-VMS, 2022 WL 4325746, at *7 (E.D.N.Y. Sept. 19, 2022) (distinguishing Van Buren and concluding that termination of CEO made him without authorization to access computers and servers he was previously able to access only through his prior employment). 100 Van Buren v. United States, 210 L. Ed. 2d 26, 141 S. Ct. 1648, 1654 (2021) (referencing “split in authority regarding the scope of liability under the CFAA’s ‘exceeds authorized access’ clause”). 101 EF Cultural Travel BV v. Zefer Corp., 318 F.3d 58, 62 (1st Cir. 2003) (“A lack of authorization could be established by an explicit statement on the website restricting access.”). 102 United States v. John, 597 F.3d 263, 271 (5th Cir. 2010) (holding that authorized access may “encompass limits placed on the use of information obtained by permitted access to a computer system and data available on that system . . . at least when the user knows or reasonably should know that he or she is not authorized to access a computer and information obtainable from that access in furtherance of or to perpetrate a crime”). 103 Int’l Airport Ctrs., LLC v. Citrin, 440 F.3d 418, 420–21 (7th Cir. 2006) (concluding that defendant lacked authorization after breaching duty of loyalty to employer). 104 United States v. Rodriguez, 628 F.3d 1258, 1263 (11th Cir. 2010) (concluding that defendant exceeded authorized access by violating employer policy against using employer database for personal purposes). 105 John, 597 F.3d at 272. 106 United States v. Valle, 807 F.3d 508, 523 (2d Cir. 2015) (concluding that an individual does not exceed authorized access where individual is authorized for certain uses, and surpasses those). 107 WEC Carolina Energy Sols. LLC v. Miller, 687 F.3d 199, 206 (4th Cir. 2012) (“[W]e adopt a narrow reading of the terms ‘without authorization’ and ‘exceeds authorized access’ and hold that they apply only when an individual accesses a computer without permission or obtains or alters information on a computer beyond that which he is authorized to access.”). 108 United States v. Nosal (Nosal I), 676 F.3d 854, 863 (9th Cir. 2012) (“Instead, we hold that the phrase ‘exceeds authorized access’ in the CFAA does not extend to violations of use restrictions.”). 109 See Valle, 807 F.3d at 528. 110 Nosal I, 676 F.3d at 856–57. 111 Van Buren v. United States, 141 S. Ct. 1648, 1662 (2021). 112 Id. at 1652. Congressional Research Service 10 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act opposed to accessing a computer or information that he is entitled to use in at least some circumstances.113 Damage The CFAA defines “damage” to mean “impairment to the integrity or availability of data, a program, a system, or information,”114 which occurs, for example, when a hacker causes a computer to behave in a manner contrary to the intentions of its owner.115 Thus, an act that causes damage under the CFAA may include “clearly destructive behavior such as using a virus or worm or deleting data ... [b]ut it may also include less obviously invasive conduct, such as flooding an email account.”116 For example, one federal court concluded that damage occurred as a result of an orchestrated effort to bombard a company’s “sales offices and three of its executives with thousands of phone calls and e-mails,” which diminished the ability of that company to use their systems.117 Prohibited Conduct Under the CFAA The CFAA prohibits seven categories of conduct, ranging from certain acts of computer trespass to unauthorized computer access with an intent to defraud.118 Cyber Espionage, 18 U.S.C § 1030(a)(1) Section 1030(a)(1)119 is a cyber-espionage provision that in certain instances prohibits obtaining and sharing national security information120—such as “information that has been determined by 113 Id. at 1662. 114 18 U.S.C. § 1030(e)(8). 115 See CRS Legal Sidebar LSB10446, An Overview of Federal Criminal Laws Implicated by the COVID-19 Pandemic, by Peter G. Berris at 2 (explaining that damage “occurs, for example, where a hacker causes a computer to behave in a manner contrary to the intentions of its owner”); accord United States v. Yücel, 97 F. Supp. 3d 413, 420 (S.D.N.Y. 2015) (construing damage under § 1030(a)(5) to include instances where a computer is caused to “no longer operate[] only in response to the commands of the owner”); see also United States v. Hutchins, 361 F. Supp. 3d 779, 794 (E.D. Wis. 2019) (concluding that use of the phrase “malware” in indictment was “sufficient to allege intent to cause damage” in CFAA prosecution). For a more detailed examination of different examples of damage, see, e.g., KERR, supra note 12 at 113–15. 116 Hutchins, 361 F. Supp. 3d at 794 (alterations in original) (quoting Fidlar Tech. v. LPS Real Estate Data Sols., Inc., 810 F.3d 1075, 1084–85 (7th Cir. 2016)). 117 Pulte Homes, Inc. v. Laborers’ Int’l Union of N. Am., 648 F.3d, 295, 299 (6th Cir. 2011). 118 18 U.S.C. § 1030. 119 18 U.S.C. § 1030(a)(1) imposes criminal penalties on: (a) Whoever-(1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information that has been determined by the United States Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations, or any restricted data, as defined in paragraph y. of section 11 of the Atomic Energy Act of 1954, with reason to believe that such information so obtained could be used to the injury of the United States, or to the advantage of any foreign nation willfully communicates, delivers, transmits, or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it. 120 Certain elements of a § 1030(a)(1) violation may be found in other federal espionage laws such as the willful (continued...) Congressional Research Service 11 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act the United States Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations.... ”121 According to DOJ, examples of national security information under § 1030(a)(1) could include “classified information obtained from a Department of Defense computer or restricted data obtained from a Department of Energy computer.”122 In practice, the provision has been rarely invoked, if at all,123 perhaps because prosecutors may charge offenses involving national security information under federal espionage statutes that overlap with § 1030(a)(1).124 Prosecutions under § 1030(a)(1) require the government to establish several elements beyond a reasonable doubt. First, the government would need to prove that the defendant obtained the national security information by knowingly125 accessing a computer without authorization or in excess of authorization.126 Section 1030(a)(1) broadly covers all computers, as opposed to just protected computers127—for example, those exclusively used by financial institutions or connected to the internet.128 Second, a § 1030(a)(1) violation requires the government to establish that the defendant had reason to believe that the information could cause “injury to the United States” or benefit “any foreign nation.”129 There is little case law expounding on this element, but DOJ has indicated that the element can likely be satisfied where “the national security information is classified or restricted” and the defendant was aware of that fact.130 Finally, the government must prove that the defendant “willfully communicate[d], deliver[ed], transmit[ted] or ... retain[ed]” the national security information, or attempted to do so, or caused the communication, delivery, or transmission of national security information.131 This element is broad, and by its own terms includes a range of activities including the failure to return national disclosure of covered classified information. E.g., 18 U.S.C. §§ 793, 794, 798; see also COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 14–16 (comparing § 1030(a)(1) to various espionage laws). 121 18 U.S.C. § 1030(a)(1). 122 COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 13. 123 See KERR, supra note 12, at 30 (“Although it is the first in the list of § 1030(a) crimes, [§ 1030(a)(1)] appears never to have been used.”). 124 See, e.g., Press Release, U.S. Dep’t of Just., Defense Department Linguist Charged with Espionage (Mar. 4, 2020), https://www.justice.gov/opa/pr/defense-department-linguist-charged-espionage (announcing charges against defendant under espionage statutes rather than § 1030(a)(1) for alleged conduct including improperly accessing United States Department of Defense “classified systems,” which defendant “had no need to access,” and transmitting that information to “a foreign terrorist organization”); accord COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 15 (“In situations where both [§ 1030(a)(1) and a federal espionage statute] ... are applicable, prosecutors may tend towards using [the espionage statutes], for which guidance and precedent are more prevalent.”). 125 Although the CFAA does not define “knowingly,” and despite a dearth of case law on § 1030(a)(1), a Senate report accompanying the 1986 amendment to the CFAA noted that a knowing act is one where the person is aware “that the result is practically certain to follow from his conduct, whatever his desire may be as to that result.” S. REP. NO. 99-432, at 6 (1986) (quoting United States v. U.S. Gypsum Co., 438 U.S. 422, 445 (1978)). That description tracks judicial interpretations of the word knowing under other subsections of the CFAA, where courts have concluded that the term excludes accidental behavior. See QVC, Inc. v. Resultly, LLC, 99 F. Supp. 3d 525, 536 (E.D. Pa. 2015) (concluding that § 1030(a)(5)(A) requires showing that “defendant intended to cause harm” and that “[d]amage caused by mere recklessness or negligence is insufficient”). 126 18 U.S.C. § 1030(a)(1). 127 Id. 128 See supra Section “Protected Computers.” 129 18 U.S.C. § 1030(a)(1). 130 U.S. DEP’T OF JUST., supra note footnote 12, at 14. 131 18 U.S.C. § 1030(a)(1). Congressional Research Service 12 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act security information or the disclosure of that information.132 However, such behavior must be intentional.133 Obtaining Information by Unauthorized Computer Access, 18 U.S.C. § 1030(a)(2) Section 1030(a)(2)134 generally prohibits accessing a computer without authorization or in excess of authorization and obtaining information in certain circumstances. Although at first glance, it could appear that to “obtain information” might refer specifically to misappropriation or theft of information, the concept is much broader.135 As interpreted by courts, “obtaining information” includes “mere observation of the data” such as looking at or reading information on a screen.136 The government has invoked § 1030(a)(2) in a variety of prosecutions,137 including in the case of several individuals for “breaking into computer networks of prominent technology companies and the U.S. Army” and stealing “more than $100 million in intellectual property,”138 two Massachusetts men for stealing social media accounts and cryptocurrency through unauthorized computer access,139 and an Italian citizen for “hack[ing] into thousands of computers without permission [and] ... gaining access to all of the information stored on those computers.”140 There are three additional statutory requirements that the government must satisfy to prove a § 1030(a)(2) violation—only one of which seems to limit the provision’s scope in a significant 132 Id. 133 Id. 134 Section 1030(a)(2) imposes criminal liability on: (a) Whoever-(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains-(A) information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602(n) of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.); (B) information from any department or agency of the United States; or (C) information from any protected computer. 135 See United States v. Drew, 259 F.R.D. 449, 457 (C.D. Cal. 2009) (“‘Obtain[ing] information from a computer’ has been described as ‘includ[ing] mere observation of the data. Actual aspiration ... need not be proved in order to establish a violation.... ’” (alterations in original) (quoting S. REP. NO. 99-432, at 6–7 (1986))); Am. Online, Inc. v. Nat’l Health Care Disc., Inc., 121 F. Supp. 2d 1255, 1276 (N.D. Iowa 2000) (relying on legislative history for the proposition that § 1030(a)(2) covers not just theft but also the observation of data). 136 See Drew, 259 F.R.D. at 457 n.13 (“[T]he term ‘obtaining information’ includes merely reading it.” (alteration in original) (quoting S. REP. NO. 104–357, at 7 (1996))). 137 Section 1030(a)(2) is “the most commonly charged section of the [CFAA].” KERR, supra note 12, at 79. 138 Press Release, U.S. Dep’t of Just., Four Members of International Computer Hacking Ring Indicted for Stealing Gaming Technology, Apache Helicopter Training Software (Sept. 30, 2014), https://www.justice.gov/opa/pr/fourmembers-international-computer-hacking-ring-indicted-stealing-gaming-technology-apache; Memorandum of Plea Agreement, United States v. Leroux, No. 13-78-GMS, 2015 WL 10372423 (D. Del. Jan. 20, 2015) (setting forth plea of guilty to conspiracy to violate § 1030(a)(2)). 139 Press Release, U.S. Dep’t of Just., Two Massachusetts Men Arrested and Charged with Nationwide Scheme to Steal Social Media Accounts and Cryptocurrency (Nov. 14, 2019), https://www.justice.gov/opa/pr/two-massachusetts-menarrested-and-charged-nationwide-scheme-steal-social-media-accounts-and; Press Release, U.S. Dep’t of Just., Massachusetts Man Pleads Guilty to Operating Nationwide Scheme to Steal Social Media Accounts and Cryptocurrency (Apr. 28, 2021), https://www.justice.gov/opa/pr/massachusetts-man-pleads-guilty-operatingnationwide-scheme-steal-social-media-accounts-and; Indictment, United States v. Meiggs, No. 19-CR-10438, 2019 WL 12117167 (D. Mass. Nov. 13, 2019). 140 United States v. Gasperini, 894 F.3d 482, 487 (2d Cir. 2018). Congressional Research Service 13 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act way.141 First, for § 1030(a)(2) to apply, the information must be obtained from either a financial institution,142 the federal government, or “any protected computer.”143 As discussed, any computer connected to the internet suffices. Second, § 1030(a)(2) requires intentional access to a computer by the defendant, “rather than mistaken, inadvertent, or careless” access.144 However, the intent requirement is a low bar to prosecution because intent to obtain information is not required; instead, all that is required is intent to access a computer without authorization or in excess of authorization.145 Third, the defendant’s access must be without authorization or in excess of authorization—elements that are discussed above. Before Van Buren, this requirement arguably did little to limit the expansive scope of § 1030(a)(2), at least in jurisdictions that had adopted a broad interpretation of the phrase “exceeds authorized access.”146 However, by limiting “exceeds authorized access” to exclude an individual who uses a computer for an unapproved reason, Van Buren solidified the element as a more meaningful limit on § 1030(a)(2) prosecutions.147 As discussed, Van Buren reversed a § 1030(a)(2) conviction on these grounds—concluding that a police officer who was authorized to access information from a law enforcement database for official purposes only, did not exceed authorized access in violation of § 1030(a)(2) by accessing information from that database for other purposes.148 Government Computer Trespassing, 18 U.S.C. § 1030(a)(3) Section 1030(a)(3)149 generally prohibits intentionally accessing a government computer without authorization. The provision establishes “a simple trespass offense,”150 which at common law often refers to an unsanctioned entry onto the land of another, regardless of whether that entry causes any harm.151 Unlike the previous two CFAA prohibitions, the crux of a § 1030(a)(3) 141 See generally KERR, supra note 12, at 81–82 (explaining breadth of § 1030(a)(2) and why requirements in that provision pose “relatively low thresholds”). 142 The provision also includes information obtained from card issuers and consumer reporting agencies. 18 U.S.C. § 1030(a)(2). 143 18 U.S.C. § 1030(a)(2). 144 S. REP. NO. 99-432, at 5 (1986). 145 United States v. Willis, 476 F.3d 1121, 1125 (10th Cir. 2007) (“A plain reading of the statute reveals that the requisite intent to prove a violation of § 1030(a)(2)(C) is ... intent to obtain unauthorized access of a protected computer.... The government need not also prove that the defendant had the intent to defraud in obtaining the information or that the information was used to any particular ends.”); United States v. Drew, 259 F.R.D. 449, 467 (C.D. Cal. 2009) (“The only scienter element in section 1030(a)(2)(C) is the requirement that the person must ‘intentionally’ access a computer without authorization or ‘intentionally’ exceed authorized access.”). 146 As one court described the pre-Van Buren landscape, barring a narrow interpretation of “without authorization” or “exceeds authorized access,” it was possible that § 1030(a)(2) could criminalize any conscious violation of ToS or other contractual restrictions on computer use. Drew, 259 F.R.D. at 457. 147 Van Buren v. United States, 141 S. Ct. 1648, 1662 (2021). 148 Id. at 1652. 149 18 U.S.C. § 1030(a)(3) imposes criminal liability on: (a) Whoever-(3) intentionally, without authorization to access any nonpublic computer of a department or agency of the United States, accesses such a computer of that department or agency that is exclusively for the use of the Government of the United States or, in the case of a computer not exclusively for such use, is used by or for the Government of the United States and such conduct affects that use by or for the Government of the United States. 150 S. REP. NO. 99-432, at 7 (1986) (clarifying that § 1030(a)(3) “applies to acts of simple trespass against computers belonging to, or being used by or for, the Federal Government”). 151 E.g., Restatement (Second) of Torts § 158 (1965). Criminal liability for trespass—under various statutes—often (continued...) Congressional Research Service 14 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act violation is unauthorized entry into a government computer, and the provision does not require that the defendant do anything with, or obtain anything from, the covered computer once he has accessed it.152 The provision is seldom invoked by prosecutors, possibly because it overlaps significantly with § 1030(a)(2), which imposes stricter penalties.153 There are two ways the government can establish a § 1030(a)(3) violation.154 First, the government may demonstrate that the defendant accessed a “nonpublic computer of a department or agency of the United States” used exclusively by the federal government.155 A nonpublic computer includes one for internal use, such as the data servers of a federal agency.156 The term nonpublic computer excludes, however, public-facing government computers, internet servers, and websites, such as those offering public services or information.157 Second, the government may establish a § 1030(a)(3) violation where the defendant accesses a “nonpublic computer of a department or agency of the United States,” if that computer is used in part by the federal government and the defendant’s “conduct affects that use.”158 A computer used in part by the federal government might include, for example, a private company’s computer on which the federal government has an account.159 In practice, “[a]lmost any network intrusion will affect the government’s use of its computers because any intrusion potentially affects the confidentiality and integrity of the government’s network and often requires substantial measures to assure the integrity of data and the security of the network.”160 Regardless of the nature of the § 1030(a)(3) violation, the government must prove that the defendant’s access was intentional and without authorization.161 The intent requirement is identical to the one in § 1030(a)(2). Although the meaning of “without authorization” is also discussed above,162 it is notable that the statute excludes liability where the defendant’s conduct merely exceeds authorized access.163 Based on legislative history, it appears that such language involves additional requirements such as notice to a person that he is trespassing, followed by that person’s knowing refusal to vacate the area in which he is trespassing. E.g., CONN. GEN. STAT. § 53a-107. 152 See COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 23 (“Section 1030(a)(3) protects against ‘trespasses’ by outsiders into federal government computers, even when no information is obtained during such trespasses.”); S. REP. 99-432 at 7 (1986) (explaining that with amendment, § 1030(a)(3) will apply “to acts of simple trespass against computers belonging to, or being used by or for, the Federal Government”); see also H.R. REP. 99-612 at 11 (1986). 153 See U.S. DEP’T OF JUST., supra note 36, at 25 (explaining why § 1030(a)(2) may be the “preferred charge” in instances where both § 1030(a)(2) and § 1030(a)(3) could apply). 154 18 U.S.C. § 1030(a)(3). 155 Id. 156 See COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 24 (“‘Nonpublic’ includes most government computers, but not Internet servers that, by design, offer services to members of the general public.”). 157 Id. 158 18 U.S.C. § 1030(a)(3). 159 COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 24. 160 Id.; see also Sawyer v. Dep’t of Air Force, 31 M.S.P.R. 193, 196 (1986) (“The elements for establishing a criminal violation of 18 U.S.C. § 1030(a)(3) ... do not include the requirement that the prohibited access to the computer system be for the specific purpose of defrauding the government. Rather, that statutory provision defines as a criminal violation the knowing unauthorized access or use of the system for any unauthorized purpose.”). 161 18 U.S.C. § 1030(a)(3). 162 See supra Section “Without Authorization and Exceeds Authorized Access.” 163 18 U.S.C. § 1030(a)(3). Congressional Research Service 15 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act was omitted to foreclose criminal liability against those who have some authorization, like federal employees approved to use a government computer, but who do so in an unapproved manner.164 Computer Fraud, 18 U.S.C. § 1030(a)(4) Section 1030(a)(4)165 is an anti-fraud provision, which makes it a crime to “knowingly and with intent to defraud, access[] a protected computer without authorization, or exceed[] authorized access” and obtain anything of value, or obtain use of the computer itself if that use is worth at least $5,000 a year.166 Prosecutors have used § 1030(a)(4) to charge a variety of fraudulent activities involving computers, including the use of a lottery terminal to falsely generate winning tickets,167 a phishing scheme that netted “hundreds of thousands of dollars,”168 and a plot to use misappropriated computer credentials to inflate grades at two universities.169 To prove a violation of § 1030(a)(4), the government must first establish that the defendant “knowingly and with intent to defraud, access[ed] a protected computer without authorization, or exceed[ed] authorized access.”170 The statute does not define what it means to act knowingly and with intent to defraud in the context of § 1030(a)(4).171 However, in the context of a civil § 1030(a)(4) claim, one federal court has indicated that “intent to defraud” means to act “willfully and with specific intent to deceive or cheat, usually for the purpose of getting financial gain for one’s self or causing financial loss to another.”172 Further guidance on the meaning of “knowingly and with intent to defraud” may be found in the legislative history of § 1030(a)(4), which notes that the identical standard is also employed in 18 U.S.C. § 1029 (governing credit card fraud).173 164 As noted in S. REP. NO. 99-432, at 7 (1986): The Committee wishes to be very precise about who may be prosecuted under the new subsection (a)(3). The Committee was concerned that a Federal computer crime statute not be so broad as to create a risk that government employees and others who are authorized to use a Federal Government computer would face prosecution for acts of computer access and use that, while technically wrong, should not rise to the level of criminal conduct. At the same time, the Committee was required to balance its concern for Federal employees and other authorized users against the legitimate need to protect Government computers against abuse by “outsiders.” 165 18 U.S.C. § 1030(a)(4) imposes criminal liability on whoever: [K]nowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period. 166 Id. 167 United States v. Bae, 250 F.3d 774, 775 (D.C. Cir. 2001). 168 United States v. Iyamu, 356 F. Supp. 3d 810, 814 (D. Minn. 2018). 169 United States v. Barrington, 648 F.3d 1178, 1184 (11th Cir. 2011). 170 18 U.S.C. § 1030(a)(4). 171 Id. § 1030(e); Good 'Nuff Garage, LLC v. McCulley, No. 3:21CV571, 2022 WL 4485810, at *14 (E.D. Va. Sept. 26, 2022); see also COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 27 (“The phrase ‘knowingly and with intent to defraud’ is not defined by section 1030. Very little case law under section 1030 exists as to its meaning, leaving open the question of how broadly a court will interpret the phrase.”). 172 Fidlar Techs. v. LPS Real Estate Data Sols., Inc., 82 F. Supp. 3d 844, 851 (C.D. Ill. 2015) (quoting United States v. Henningsen, 387 F.3d 585, 590–91 (7th Cir. 2004)), aff’d, 810 F.3d 1075 (7th Cir. 2016); see also United States v. Nosal (Nosal I), 676 F.3d 854, 864 (9th Cir. 2012) (Silverman J., dissenting) (concluding that § 1030(a)(4) requires specific intent to defraud). More generally, other federal courts have concluded that to “defraud” under § 1030(a)(4) refers broadly to wrongdoing rather than to the specific elements of common law fraud. See, e.g., Hanger Prosthetics & Orthotics, Inc. v. Capstone Orthopedic, Inc., 556 F. Supp. 2d 1122, 1131 (E.D. Cal. 2008) (“The term ‘defraud’ for purposes of § 1030(a)(4) simply means wrongdoing and does not require proof of common law fraud.”). 173 S. REP. NO. 99-432, at 10 (1986). Congressional Research Service 16 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act In the context of § 1029, at least one federal appellate court has concluded that § 1029 requires proof of the defendant’s “intent to deceive and cheat, which means the government must prove that the defendant had the intent to deprive a victim of money or property by deception.”174 There are two additional requirements for violations of § 1030(a)(4). First, the government must prove that in accessing the protected computer, the defendant furthered the fraud.175 In other words, the access must be “directly linked to the intended fraud.”176 Thus, § 1030(a)(4) does not govern frauds where the computer use is incidental—for example, where an individual simply uses the computer for record keeping or to “add up his potential ‘take’ from the [fraud].”177 Second, the government must prove that the defendant obtained “anything of value.”178 That element is “easily met if the defendant obtained money, cash, or a good or service with measurable value.”179 One “typical item of value” is data,180 but merely viewing information may not suffice on its own.181 Rather, as at least one court has concluded, the information must be valuable not merely in the abstract, but specifically to the defendant “in light of a fraudulent scheme.”182 Thus, information may not be a thing of value when viewed only to “satisfy idle curiosity.”183 Computer use, in and of itself, also may be a thing of value for the purposes of § 1030(a)(4), but only if that use is worth at least $5,000 a year.184 The concept of computer use as a thing of value is underdeveloped in case law, but a Senate report accompanying the 1986 Amendment to the CFAA provides some indication that computer use may be a thing of value where it reduces computer availability that would otherwise generate revenue for the computer owner through usage fees paid by valid users.185 Although at least one observer has suggested that this idea is outmoded given the modern prevalence of computers and the corresponding decrease in the value of computer use,186 DOJ has suggested that it may still be possible for computer use to meet the $5,000 threshold in the case of recurring or continuing use of an expensive computer.187 In any event, the $5,000 threshold for fraud solely resulting in computer use is intended to prevent § 1030(a)(4) from encompassing mere computer trespass in most cases.188 As the same 1986 Senate report observed, if every trespass were thought of as “an attempt to defraud a service provider of 174 United States v. Saini, 23 F.4th 1155, 1160 (9th Cir. 2022) (emphasis omitted). 175 18 U.S.C. § 1030(a)(4). 176 S. REP. NO. 99-432, at 9 (1986). 177 Id. 178 18 U.S.C. § 1030(a)(4). 179 COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 32. 180 In re Am. Online, Inc., 168 F. Supp. 2d 1359, 1380 (S.D. Fla. 2001). 181 United States v. Czubinski, 106 F.3d 1069, 1078–79 (1st Cir. 1997) (reversing defendant’s § 1030(a)(4) conviction for obtaining information where the “evidence did not show that [defendant’s] end was anything more than to satisfy his curiosity,” because the “[t]he value of information is relative to one’s needs and objectives” and “the government had to show that the information was valuable to [the defendant] in light of a fraudulent scheme”). 182 Id. at 1078. 183 Id. 184 18 U.S.C. § 1030(a)(4). 185 S. REP. NO. 99-432, at 10 (1986) (“The Committee agrees that the mere use of a computer or computer service has a value all its own. Mere trespasses onto someone else’s computer system can cost the system provider a ‘port’ or access channel that he might otherwise be making available for a fee to an authorized user.”). 186 KERR, supra note 12, at 102–03. 187 COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 32. 188 See Czubinski, 106 F.3d at 1078 (reviewing legislative history supporting conclusion that “Congress intended section 1030(a)(4) to punish attempts to steal valuable data, and did not wish to punish mere unauthorized access”). Congressional Research Service 17 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act computer time,” it would obliterate the distinction between § 1030(a)(4) and the CFAA provisions that prohibit trespass.189 In practice, it is difficult to invoke § 1030(a)(4) against a computer trespasser in the absence of other conduct, because courts may be reluctant to infer adequate proof of an intent to defraud from mere unauthorized computer access or even observation of data.190 Rather, for at least one federal court, unauthorized access must be coupled with “the showing of some additional end—to which the unauthorized access is a means.”191 Damaging a Computer, 18 U.S.C. § 1030(a)(5) Broadly speaking, § 1030(a)(5)192 prohibits a variety of acts that result in damage to a computer, including: • • knowingly causing the transmission of “a program, information, code, or command,” and thereby “intentionally caus[ing] damage without authorization to a protected computer;” and intentionally accessing a protected computer without authorization, and thereby: o recklessly causing damage, or o causing damage or loss. Subsection 1030(a)(5) may be used to prosecute many of the activities that are commonly associated with hacking, such as the transmission of viruses or worms193 and unauthorized access by intruders who delete files or shut off computers.194 The provision may also be used to prosecute the perpetrators of Distributed Denial of Service (DDoS) attacks,195 which occur, for example, when an attacker overwhelms a server’s ability to process legitimate requests by overloading the server with a flood of illegitimate traffic.196 The government has invoked § 1030(a)(5) in a variety of prosecutions, such as those of a Russian national for deploying malware 189 S. REP. NO. 99-432, at 10 (1986). 190 Czubinski, 106. F3d at 1075 (concluding that government did not adequately prove “intent to deprive ... and, a fortiori, a scheme to defraud” where defendant accessed computer and looked at confidential information, but there was no evidence that defendant intended to use that information for anything other than browsing). 191 Id. at 1078. 192 18 U.S.C. § 1030(a)(5) imposes criminal liability on: (a) Whoever-(5)(A) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; (B) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or (C) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss. 193 “In the colorful argot of computers, a ‘worm’ is a program that travels from one computer to another but does not attach itself to the operating system of the computer it ‘infects.’ It differs from a ‘virus,’ which is also a migrating program, but one that attaches itself to the operating system of any computer it enters and can infect any other computer that uses files from the infected computer.” United States v. Morris, 928 F.2d 504, 505 n.1 (2d Cir. 1991). 194 COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 35. 195 E.g., United States v. Gottesfeld, 18 F.4th 1, 4 (1st Cir. 2021), cert. denied, 143 S. Ct. 85 (2022) (affirming § 1030(a)(5) conviction of defendant for a DDoS attack he committed against Boston Children's Hospital and Wayside Youth and Family Support Network). 196 Understanding Denial-of-Service Attacks, CYBERSEC. & INFRASTRUCTURE SEC. AGENCY (Feb. 01, 2021), https://www.cisa.gov/news-events/news/understanding-denial-service-attacks. Congressional Research Service 18 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act that “resulted in tens of millions of dollars of losses to victims worldwide”;197 an Illinois resident for developing websites used to launch “millions of DDoS attacks that disrupted the internet connections of targeted victim computers”;198 and the former IT employee of a major railroad who damaged his employer’s computer network by “strategically delet[ing] files, remov[ing] administrative-level accounts, and chang[ing] passwords.”199 Section 1030(a)(5) has also been used to prosecute the developers and purveyors of malware, such as ransomware, often in conjunction with inchoate offenses like conspiracy and aiding and abetting.200 The first act that § 1030(a)(5) criminalizes—specifically, under subsection (A)—is to “knowingly cause[] the transmission of a program, information, code, or command” and thereby “intentionally cause[] damage without authorization, to a protected computer.”201 The CFAA does not define “transmission,”202 but the phrase likely “encompasses a range of hacking activities, such as ‘[t]he transfer of operational or confidential information,’ ‘malicious software updates,’ ‘code injection attacks,’ DDoS, and the ‘embedding of malicious code’ or malware.”203 Transmission may occur through use of the internet or physical media like compact discs.204 197 Press Release, U.S. Dep’t of Just., Russian National Charged with Decade-Long Series of Hacking and Bank Fraud Offenses Resulting in Tens of Millions in Losses and Second Russian National Charged with Involvement in Deployment of “Bugat” Malware (Dec. 5, 2019), https://www.justice.gov/opa/pr/russian-national-charged-decade-longseries-hacking-and-bank-fraud-offenses-resulting-tens (quoting statement of Assistant Attorney General Brian A. Benczkowski). 198 Press Release, U.S. Dep’t of Just., Former Operator of Illegal Booter Services Sentenced for Conspiracy to Commit Computer Damage and Abuse (Nov. 15, 2019), https://www.justice.gov/opa/pr/former-operator-illegal-booter-servicessentenced-conspiracy-commit-computer-damage-and-abuse. 199 Press Release, U.S. Dep’t of Just., Former IT Employee of Transcontinental Railroad Sentenced to Prison for Damaging Ex-Employer’s Computer Network (Feb. 13, 2018), https://www.justice.gov/opa/pr/former-it-employeetranscontinental-railroad-sentenced-prison-damaging-ex-employer-s-computer. 200 For instance, prosecutors charged a member of a North Korean hacking team for conspiracy to violate CFAA provisions such as § 1030(a)(5) in connection with a scheme that involved developing the ransomware known as WannaCry2.0. Press Release, U.S. Dep’t of Just., North Korean Regime-Backed Programmer Charged With Conspiracy to Conduct Multiple Cyber Attacks and Intrusions (Sept. 6, 2018), https://www.justice.gov/opa/pr/northkorean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and; Criminal Complaint, United States v. Park Jin Hyok, No. MJ18-1479 (C.D. Cal. June 8, 2018). As another example, federal prosecutors charged one individual under § 1030(a)(5), among other things, in connection with his “creation and distribution of the Kronos banking Trojan and UPAS kit malware.” Press Release, U.S. Dep’t of Just., Marcus Hutchins Pleads Guilty to Creating and Distributing the Kronos Banking Trojan and UPAS Kit Malware (May 3, 2019), https://www.justice.gov/usao-edwi/pr/marcus-hutchins-pleads-guilty-creating-and-distributing-kronos-banking-trojanand-upas; First Superseding Indictment, United States v. Hutchins, No. 2:17-CR-00124, 2018 WL 7325296 (E.D. Wis. June 5, 2018). Prosecutors also used § 1030(a)(5), along with other provisions, to charge a Swedish national responsible for the sale of malware to “thousands of people in more than 100 countries.” Press Release, U.S. Dep’t of Just., Swedish Co-Creator Of “Blackshades” Malware That Enabled Users Around The World To Secretly And Remotely Control Victims’ Computers Sentenced To 57 Months In Prison (June 23, 2015), https://www.justice.gov/usao-sdny/pr/swedish-co-creator-blackshades-malware-enabled-users-around-world-secretlyand-remotely; United States v. Yücel, 97 F. Supp. 3d 413, 416 (S.D.N.Y. 2015). 201 18 U.S.C. § 1030(a)(5)(A). 202 Patrick Patterson Custom Homes, Inc. v. Bach, 586 F. Supp. 2d 1026, 1034 (N.D. Ill. 2008). 203 Beale & Berris, supra note 1, at 170 (quoting Ioana Vasiu & Lucian Vasiu, Break on Through: An Analysis of Computer Damage Cases, 14 U. PITT. J. TECH. L. POL’Y 158, 167–69 (2014)); see also Lloyd v. United States, No. CIV.03-813(WHW), 2005 WL 2009890, at *7–*8 (D.N.J. Aug. 16, 2005) (discussing the breadth of “transmission” under CFAA). 204 Meridian Fin. Advisors, Ltd. v. Pence, 763 F. Supp. 2d 1046, 1061 (S.D. Ind. 2011); see also United States v. Sullivan, 40 F. App’x 740, 743–44 (4th Cir. 2002) (per curiam) (concluding that a transmission under 18 U.S.C. § 1030(a)(5)(A) occurred through insertion of code into a computer system that eventually found its way into hand-held computers); N. Tex. Preventive Imaging LLC v. Eisenberg, No. SA CV 96-71AHS(EEX), 1996 WL 1359212, at *6 (C.D. Cal. Aug. 19, 1996) (“The transmission of a disabling code by floppy computer disk may fall within ... [§ 1030(a)(5)(A)], if accompanied by the intent to cause harm.”). Congressional Research Service 19 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act Some courts have gone so far as to conclude that the exact means of transmission is irrelevant, focusing instead on whether the program, information, code, or command caused damage.205 The CFAA also does not define the phrase “program, information, code, or command.”206 The phrase seemingly includes “all transmissions that are capable of having an effect on a computer’s operation,” such as worms, “software commands (such as an instruction to delete information),” and “network packets designed to flood a network connection or exploit system vulnerabilities.”207 To prove a § 1030(a)(5)(A) violation, the government must establish dual mental states on the part of the defendant. First, the government must prove that the defendant’s transmission was knowing.208 The CFAA does not define “knowing,”209 but it almost certainly excludes accidental transmission—for example, in the case of an unsuspecting user who forwards an email with malware attached in a file or link.210 Second, the government must prove that the defendant intentionally caused damage to a protected computer without authorization.211 The meanings of “protected computer,” “without authorization,” and “damage” are discussed in detail above. According to at least one court, the requirement of intent to cause damage in the context of § 1030(a)(5)(A) means that the defendant had the “conscious purpose of causing damage ... to [the relevant] computer.”212 Other violations of § 1030(a)(5) may occur where a defendant intentionally accesses a protected computer without authorization and causes damage, even if he does not intend to cause such damage.213 However, for such unintended damage to amount to a § 1030(a)(5) violation, it must either be reckless or result in loss.214 Although the CFAA does not define what it means to recklessly cause damage, in general the “normal meaning of reckless in the criminal law (unlike 205 See, e.g., Patrick Patterson Custom Homes, 586 F. Supp. 2d at 1035 (“While Plaintiffs acknowledge that the precise method of installation of the erasure program is unknown, the Seventh Circuit recognizes that the precise mode of transmission is irrelevant.”). 206 18 U.S.C. § 1030(e). 207 COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 37; see also United States v. Morris, 928 F.2d 504, 505 (2d Cir. 1991) (affirming § 1030(a)(5)(A) conviction of defendant who created and released a worm); Arience Builders, Inc. v. Baltes, 563 F. Supp. 2d 883, 884 (N.D. Ill. 2008) (discussing when instructions to delete information may amount to transmission of a command for CFAA purposes). 208 18 U.S.C. § 1030(a)(5)(A). 209 Id. § 1030(e). 210 For example, in the context of another federal criminal statute, one federal appellate court approved of jury instructions that conduct is undertaken “knowingly” when “the defendant realized what he was doing and was aware of the nature of his conduct, and did not act through ignorance, mistake or accident.” United States v. Salinas, 763 F.3d 869, 879 (7th Cir. 2014); see also Good 'Nuff Garage, LLC v. McCulley, No. 3:21CV571, 2022 WL 4485810, at *14 (E.D. Va. Sept. 26, 2022) (discussing use of “knowingly” in another CFAA provision and explaining that “in the criminal context, ‘knowingly’ is often interpreted to mean that a party acted ‘voluntarily and intentionally and not because of accident, mistake or some other innocent reason.’” (quoting United States v. Fall, No. 2:17CR12, 2018 WL 9854664, at *2 (E.D. Va. May 14, 2018), aff'd, 955 F.3d 363 (4th Cir. 2020))). 211 18 U.S.C. § 1030(a)(5)(A). 212 Pulte Homes, Inc. v. Laborers’ Int’l Union of N. Am., 648 F.3d 295, 303 (6th Cir. 2011); accord United States v. Carlson, 209 F. App’x 181, 184 (3d Cir. 2006) (discussing § 1030(a)(5) prosecution and noting that although CFAA does not define “intentionally,” “this Court has defined it in the criminal context as performing an act deliberately and not by accident”); see also QVC, Inc. v. Resultly, LLC, 99 F. Supp. 3d 525, 536 (E.D. Pa. 2015) (concluding that § 1030(a)(5)(A) requires showing that “defendant intended to cause harm” and that “[d]amage caused by mere recklessness or negligence is insufficient”). 213 18 U.S.C. § 1030(a)(5). 214 Id. Congressional Research Service 20 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act the civil law) is that the defendant disregarded ‘a risk of harm of which he is aware.’”215 Case law specific to the CFAA provides few illustrations, but an individual may recklessly cause damage to a computer if he is aware of the risk that his unauthorized computer access may cause damage and proceeds anyway in a way that does indeed damage the computer.216 The CFAA defines “loss” as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.”217 Federal courts disagree on whether proving interruption of service—such as computer systems or files being rendered unavailable—is a prerequisite to demonstrating loss.218 In other words, some courts construe loss to include reasonable costs caused by offenses regardless of whether those offenses involve service interruption, but other courts more narrowly interpret loss under the CFAA as requiring service interruption.219 Password Trafficking, 18 U.S.C. § 1030(a)(6) Section 1030(a)(6)220 is a rarely used221 provision of the CFAA designed to protect computer passwords.222 The provision is “aimed at penalizing conduct associated with ‘pirate bulletin boards,’ where passwords are displayed that permit unauthorized access to others’ computers.”223 Specifically, the law, assuming an appropriate jurisdictional nexus discussed below, makes it a crime to traffic “knowingly and with intent to defraud” in “any password or similar information 215 United States v. McCord, Inc., 143 F.3d 1095, 1098 (8th Cir. 1998) (quoting Farmer v. Brennan, 511 U.S. 825, 837 (1994)). 216 For example, one federal court found that a plaintiff sufficiently alleged a civil § 1030(a)(5) violation with allegations that the defendant recklessly caused damage by unauthorized computer access where he deleted data from the plaintiff’s website, accounts, and server. MSC Safety Sols., LLC v. Trivent Safety Consulting, LLC, No. 19-CV00938-MEH, 2019 WL 5189004, at *4 (D. Colo. Oct. 15, 2019). 217 18 U.S.C. § 1030(e)(11). For a detailed examination of “loss,” see, e.g., KERR, supra note 12, at 124–30. 218 See, e.g., Brown Jordan Int’l, Inc. v. Carmicle, 846 F.3d 1167, 1173–74 (11th Cir. 2017) (comparing jurisdictions that construe loss broadly to include any costs of responding to an offense, regardless of whether there was an interruption of service, with those that narrowly construe loss as resulting only from an interruption of service). 219 Compare id. (adopting broad view of loss that includes reasonable costs of responding to an offense even where there was no interruption of service), and Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, 774 F.3d 1065, 1073 (6th Cir. 2014) (holding that loss under the CFAA includes both consequential damages caused by service interruption and reasonable costs of responding to an offense such as damage assessments), with Gen. Sci. Corp. v. SheerVision, Inc., No. 10-CV-13582, 2011 WL 3880489, at *4 (E.D. Mich. Sept. 2, 2011) (“The CFAA only covers lost revenue if the loss occurred as a result of interrupted service.”), and CoStar Realty Info., Inc. v. Field, 737 F. Supp. 2d 496, 515 (D. Md. 2010) (“[A] violation of the CFAA must cause an interruption of service in order for lost revenue to constitute as a qualifying ‘loss’ under the statute.”). 220 18 U.S.C. § 1030(a)(6) imposes criminal liability on: (a) Whoever-(6) knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if-(A) such trafficking affects interstate or foreign commerce; or (B) such computer is used by or for the Government of the United States. 221 For example, as of December 27, 2022, a search of the Westlaw database for reported federal cases yielded 33 results that included the phrase “1030(a)(6),” which would be expected in cases discussing that subsection. See also AtPac, Inc. v. Aptitude Sols., Inc., 730 F. Supp. 2d 1174, 1182 (E.D. Cal. 2010) (“The court notes that, in the course of its own research, it has come across only a handful of federal cases that even mention § 1030(a)(6).”) 222 S. REP. NO. 99-432, at 13 (1986). 223 Id. Congressional Research Service 21 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act through which a computer may be accessed without authorization.”224 For the purposes of § 1030(a)(6), “traffic” means to “transfer, or otherwise dispose of, to another, or obtain control of with intent to transfer or dispose of.”225 According to at least one court, “trafficking” under § 1030(a)(6) may include the “very common act of giving someone else your password,” but such behavior “becomes illegal” only where the other elements of §1030(a)(6) are satisfied and where “the password can enable the password recipient to access a computer without authorization.”226 Based on the definition of “traffic,” a defendant must intend to transfer or dispose of the passwords or similar information.227 “Knowingly with intent to defraud” is the same standard used in § 1030(a)(4), discussed above, and generally refers to acts undertaken with the knowledge that defrauding another is a likely consequence, and the intent that such fraud should actually occur.228 One federal court concluded that intent to defraud “in the § 1030(a)(6) context requires more than the intent to impermissibly give access to another.”229 Thus, in that case, the court concluded that the act of sharing a password without permission—even if it potentially violated a license agreement—did not “rise to an inference of any ‘intent to defraud’” without additional factual allegations of fraud.230 “Password[s] or similar information”231 is a broad category intended to include not “only a single word that enables one to access a computer,” but also “longer more detailed explanations on how to access others’ computers.”232 For § 1030(a)(6) to apply, the defendant’s actions must satisfy one of two jurisdictional hooks. First, § 1030(a)(6) could apply where the “trafficking affects interstate or foreign commerce.”233 Although undefined by the CFAA and underdeveloped in case law, at least some courts examining civil § 1030(a)(6) claims appear to have construed the interstate or foreign commerce requirement broadly.234 For example, for at least one court, trafficking involving the internet could satisfy the requirement.235 Second, § 1030(a)(6) may also apply where the defendant traffics in passwords or similar information that would allow unauthorized entry into a “computer ... used by or for the Government of the United States.”236 Again there is no statutory definition and little interpretive case law, but according to DOJ the “plain meaning [of the phrase] should encompass any computer used for official business by a federal government employee or on behalf of the federal government.”237 However, it is at least possible that the provision only 224 18 U.S.C. § 1030(a)(6). 225 Id. § 1029(e)(5); see id. § 1030. 226 AtPac, Inc., 730 F. Supp. 2d at 1182–83. 227 18 U.S.C. §§ 1029(e)(5), 1030(a)(6); accord COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 50. 228 See supra Section “Computer Fraud, 18 U.S.C. § 1030(a)(4)” 229 AtPac, Inc., 730 F. Supp. 2d at 1183. 230 Id. 231 18 U.S.C. § 1030(a)(6). 232 S. REP. NO. 99-432, at 13 (1986); accord COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 50 (“Therefore, prosecutors should apply the term ‘password’ using a broad meaning to include any instructions that safeguard a computer.”). 233 18 U.S.C. § 1030(a)(6)(A). 234 See Tracfone Wireless, Inc. v. Simply Wireless, Inc., 229 F. Supp. 3d 1284, 1297 (S.D. Fla. 2017) (concluding that plaintiff stated claim under § 1030(a)(6) where trafficking implicated the internet and a telecommunications network). 235 Id. Courts have reached similar conclusions when interpreting 18 U.S.C. § 1029, a credit card fraud statute that prohibits trafficking that “affects interstate or foreign commerce.” See, e.g., United States v. Rushdan, 870 F.2d 1509, 1513–14 (9th Cir. 1989) (concluding that federal jurisdiction under § 1029 included “possession of the numbers of out of state credit card accounts”). 236 18 U.S.C. § 1030(a)(6)(B). 237 COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 51. Congressional Research Service 22 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act applies to passwords for executive branch agencies. That is because unlike other CFAA provisions, § 1030(a)(6) does not specify that a government computer is one used by any “department or agency of the United States”—a phrase that the CFAA specifically defines as including legislative, executive, and judicial branch computers.238 Thus, the use in § 1030(a)(6) of the phrase “computer.... used by or for the Government of the United States” might be interpreted to have a meaning narrower than the phrase “computer[s] of a department or agency of the United States” used elsewhere in the CFAA.239 Threats and Extortion, 18 U.S.C. § 1030(a)(7) Section 1030(a)(7)240 prohibits certain extortionate threats concerning a protected computer, such as threats to cause damage to, or disclose confidential information from, a protected computer unless given money or a thing of value.241 The provision has been described as “a high-tech variation on old fashioned extortion.”242 Although a number of other federal criminal statutes also prohibit extortionate threats, the CFAA’s legislative history suggests that Congress’s concern in enacting this provision was that other “extortion statutes, which protect against physical injury to person or property, [might not] cover intangible computerized information.”243 In particular, the Senate report accompanying the 1996 Amendment to the CFAA noted concern with threats against computer systems such as “situations in which hackers penetrate a system, encrypt a database and then demand money for the decoding key.”244 Prosecutors have invoked § 1030(a)(7) to charge a variety of threats against computer systems themselves, such as ransomware plots that use software to encrypt the victim’s computer files (rendering them unavailable) until payment is received to unlock those systems.245 The government has also relied 238 18 U.S.C. § 1030(e)(7) (“[T]he term ‘department of the United States’ means the legislative or judicial branch of the Government or one of the executive departments.... ”). 239 Given the lack of interpretive case law, this possibility remains speculative. DOJ has noted that “used by or for the Government of the United States” also appears in § 1030(a)(3) and that the plain meaning of the phrase “should encompass any computer used for official business by a federal government employee or on behalf of the federal government.” COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 51. There are differences between the use of the phrase in § 1030(a)(3) and § 1030(a)(6), however. Unlike § 1030(a)(6), the language of § 1030(a)(3) applies only where the unauthorized access is of “any nonpublic computer of a department or agency of the United States.” 18 U.S.C. § 1030(a)(3) (emphasis added). Thus, § 1030(a)(3) incorporates a phrase defined by the CFAA to include computers of all three branches of government, supra note 238, whereas § 1030(a)(6) does not. 240 18 U.S.C. § 1030(a)(7) imposes criminal liability on: (a) Whoever-(7) with intent to extort from any person any money or other thing of value, transmits in interstate or foreign commerce any communication containing any-(A) threat to cause damage to a protected computer; (B) threat to obtain information from a protected computer without authorization or in excess of authorization or to impair the confidentiality of information obtained from a protected computer without authorization or by exceeding authorized access; or (C) demand or request for money or other thing of value in relation to damage to a protected computer, where such damage was caused to facilitate the extortion. 241 Id. 242 See S. REP. NO. 104-357, at 12 (1996). 243 Id. (quoting statement of Attorney General to Sen. Leahy). 244 Id. 245 See, e.g., Indictment, United States v. Savandi, No. 3:18-cr-00704-BRM, 2018 WL 6798078 (D.N.J. Nov. 27, 2018); Press Release, U.S. Dep’t of Just., Two Iranian Men Indicted for Deploying Ransomware to Extort Hospitals, (continued...) Congressional Research Service 23 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act on § 1030(a)(7) to prosecute instances in which computers are not the subject of the threat, but rather the means of extortion. For instance, prosecutors have brought charges under § 1030(a)(7) against a hacker who obtained “sensitive records and information” from victim computers, which he threatened to release unless paid a ransom.246 As another illustration, federal prosecutors invoked § 1030(a)(7) in charging a former government employee who used stolen passwords to obtain “sexually explicit photographs ... from victims’ email and social media accounts,” which he “threatened to share ... unless the victims ceded to certain demands.”247 Section 1030(a)(7) specifically prohibits three categories of extortionate threats. First, the provision criminalizes “threat[s] to cause damage to a protected computer.”248 Threats to cause damage might include threats to “interfer[e] in any way with the normal operation of the computer or system in question, such as [by] denying access to authorized users, erasing or corrupting data or programs, slowing down the operation of the computer or system, or encrypting data and then demanding money for the key.”249 Second, § 1030(a)(7) proscribes “threat[s] to obtain information from a protected computer without authorization or in excess of authorization or to impair the confidentiality of information obtained from a protected computer without authorization or by exceeding authorized access.”250 In other words, this second category includes extortionate threats to obtain information through unauthorized access to a protected computer, or to disclose information already obtained through unauthorized access to a protected computer.251 For example, an individual may fall within this second category when he threatens to hack into a protected computer and obtain sensitive information.252 He may also fall within the category if he has already hacked into the computer and obtained the information, and he subsequently threatens to disclose it. This latter category could include double extortion ransomware schemes where an attacker not only uses ransomware but also breaches a computer system, steals sensitive information, and threatens to disclose that information if ransom is not paid.253 Third, it is a crime under § 1030(a)(7) to issue a “demand or request for money or [an]other thing of value in relation to damage to a protected computer, where such damage was caused to facilitate the extortion.”254 An example of this type of threat is the use of ransomware to Municipalities, and Public Institutions, Causing Over $30 Million in Losses (Nov. 28, 2018), https://www.justice.gov/opa/pr/two-iranian-men-indicted-deploying-ransomware-extort-hospitals-municipalities-andpublic. The installation of such ransomware may also violate § 1030(a)(5). See Indictment, Savandi, 2018 WL 6798078 (No. 3:18 cr-00704-BRM) (charging defendants under both 18 U.S.C. § 1030(a)(7)(C) and § 1030(a)(5)(A)). 246 Press Release, U.S. Dep’t of Just., Member of “The Dark Overlord” Hacking Group Extradited From United Kingdom to Face Charges in St. Louis (Dec. 18, 2019), https://www.justice.gov/opa/pr/member-dark-overlord-hackinggroup-extradited-united-kingdom-face-charges-st-louis. See also Indictment, United States v. Wyatt, No. 4:17-cr00522-RLW-SPM, 2017 WL 11530077 (E.D. Mo. Nov. 8, 2017). 247 Press Release, U.S. Dep’t of Just., Former U.S. Government Employee Charged in Computer Hacking and Cyber Stalking Scheme (Aug. 19, 2015), https://www.justice.gov/opa/pr/former-us-government-employee-charged-computerhacking-and-cyber-stalking-scheme; see also Indictment, United States v. Ford, No. 1 15-CR-319, 2015 WL 4980336 (N.D. Ga. Aug. 18, 2015). 248 18 U.S.C. § 1030(a)(7)(A). 249 See S. REP. NO. 104-357, at 12 (1996). 250 18 U.S.C. § 1030(a)(7)(B) (emphasis added). 251 Id. 252 Indictment, Ford, 2015 WL 4980336 (No. 1 15-CR-319). 253 CRS Report R46932, Ransomware and Federal Law: Cybercrime and Cybersecurity, by Peter G. Berris and Jonathan M. Gaffney, at 4. 254 18 U.S.C. § 1030(a)(7)(C). Congressional Research Service 24 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act extort payment in exchange for providing the decryption key for the victim’s files,255 and prosecutors have used the subsection to charge such conduct.256 There are two important limitations to § 1030(a)(7) as it pertains to all three categories of threats. First, for § 1030(a)(7) to apply, the defendant must have acted “with intent to extort from any person any money or other thing of value.”257 In general, extortion refers to “obtaining something or compelling some action by illegal means, as by force or coercion.”258 In the context of § 1030(a)(7), courts have found the requisite intent to extort where, for example, defendants wrongfully obtained confidential information or credentials and demanded money for their return.259 However, it may not be necessary to establish “that the defendant actually succeeded in obtaining the money or thing of value, or that the defendant actually intended to carry out the threat made.”260 Second, the defendant must have transmitted the threat “in interstate or foreign commerce”261—for example, by transmitting the threat through the internet or between computers in two different states.262 Remedies and Penalties The CFAA authorizes a number of remedies for violations of its various prohibitions. Most obviously, violations of the CFAA provisions discussed above are subject to various criminal penalties of fines and imprisonment.263 The nature of those penalties varies based on the specific subsection at issue (see Table 1).264 For example, the maximum prison term for first-time CFAA offenders is one year under § 1030(a)(3),which governs certain acts of trespassing in government computers,265 but five years under § 1030(a)(4), which is the main anti-fraud provision in the 255 Berris & Gaffney, supra note 253, at 3. 256 See, e.g., Indictment, Savandi, 2018 WL 6798078 (No. 3:18-cr-00704-BRM); Press Release, U.S. Dep’t of Just., Two Iranian Men Indicted for Deploying Ransomware to Extort Hospitals, Municipalities, and Public Institutions, Causing Over $30 Million in Losses (Nov. 28, 2018), https://www.justice.gov/opa/pr/two-iranian-men-indicteddeploying-ransomware-extort-hospitals-municipalities-and-public. The installation of such ransomware may also violate § 1030(a)(5). See Indictment, Savandi, 2018 WL 6798078 (No. 3:18-cr-00704-BRM) (charging defendants under both 18 U.S.C. § 1030(a)(7)(C) and § 1030(a)(5)(A)). 257 18 U.S.C. § 1030(a)(7). 258 Extortion, BLACK’S LAW DICTIONARY (11th ed. 2019). 259 See, e.g., Inplant Enviro-Sys. 2000 Atlanta, Inc. v. Lee, No. 1:15-CV-0394-LMM, 2015 WL 13297963, at *4 (N.D. Ga. June 9, 2015) (holding that plaintiff alleged a valid claim for § 1030(a)(7) violation where defendant allegedly demanded $137,705 for the return of master access to the plaintiff’s domains). 260 COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 53. 261 18 U.S.C. § 1030(a)(7). 262 See Inplant Enviro-Sys. 2000 Atlanta, Inc., 2015 WL 13297963, at *4 (No. 1:15-CV-0394-LMM ) (concluding that plaintiff adequately stated a § 1030(a)(7) violation against defendant who transmitted extortionate communication “in interstate or foreign commerce, as [it was] sent via internet”); accord United States v. Kammersell, 196 F.3d 1137, 1139 (10th Cir. 1999) (concluding that interstate commerce element of 18 U.S.C. § 875(c)—a federal threat statute— was satisfied where defendant transmitted threat via instant message between computers in the same state, where it was routed to a server in a second state). 263 18 U.S.C. § 1030. The CFAA gives the FBI “primary authority to investigate” certain CFAA violations, such as those involving espionage or national security information, but the statute also expressly permits investigation by the United States Secret Service and any other agency with authority. 18 U.S.C. § 1030(d); accord FED. BUREAU OF INVESTIGATION, The Cyber Threat, https://www.fbi.gov/investigate/cyber. The Department of Justice prosecutes CFAA violations. See generally COMPUT. CRIME & INTELL. PROP. SECTION, CRIM. DIV., U.S. DEP’T OF JUST., supra note 12, at 1-56 (summarizing DOJ interpretation guidance on CFAA prosecutions). 264 18 U.S.C. § 1030. 265 Id. § 1030(c)(2)(A). Congressional Research Service 25 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act CFAA.266 The distinction between first-time and repeat offenses is also relevant in the CFAA (see Table 1). For instance, under § 1030(a)(1)—which prohibits obtaining and disclosing national security information through unauthorized computer access—a violation is generally subject to a maximum prison term of ten years, a fine, or both.267 If that violation occurs after another CFAA offense, it is subject to a maximum prison term of twenty years, a fine, or both.268 Within some CFAA provisions, the relevant penalties also depend on the gravity of the defendant’s conduct (see Table 2; Table 3; Table 4). For example, under § 1030(a)(2)—prohibiting obtaining information in certain circumstances—the penalties are stiffer if the value of the information obtained is greater than $5,000 (see Table 2).269 The CFAA provision prohibiting damage to computers—§ 1030(a)(5)—offers another illustration (see Table 3; Table 4). It authorizes longer prison terms for certain outcomes, such as when a violation results in bodily injury or death.270 The prison terms covered in this section are the maximum authorized by the CFAA for each offense; the sentence actually imposed on a given defendant may be less and is a determination informed by the United States Sentencing Guidelines.271 With respect to fines, the amounts will vary based on the corresponding prison term authorized by each CFAA subsection. Unless the underlying statute specifies otherwise, for felonies—violations of statutes authorizing a maximum prison term of more than one year272—the default maximum fine level is the greater of $250,000 ($500,000 in the case of organizations) or twice the gain or loss associated with the offense.273 The default maximum fine level for misdemeanors varies.274 A federal statute classifies the misdemeanor offenses contained in the CFAA as Class A misdemeanors because they are punishable by up to one year of imprisonment.275 The default maximum fine level for Class A Misdemeanors not resulting in death is the greater of $100,000 ($200,000 in the case of organizations) or twice the gain or loss associated with the offense.276 Table 1. Overview of CFAA Maximum Penalties Maximum Prison Terms by Subsection for First and Subsequent Offenses Section* Description First Offense** Subsequent Offense*** 1030(a)(1) Cyber Espionage 10 Years 20 Years 1030(a)(2) Obtaining Information by Unauthorized Computer Access 1 Year (M); 5 Years (F) 10 Years 1030(a)(3) Government Computer Trespassing 1 Year 10 Years 1030(a)(4) Computer Fraud 5 Years 10 Years 1030(a)(5)(A) Knowing Transmission + Intentional Damage to Computer 1 Year (M); 10 Years (F) 20 Years 266 Id. § 1030(c)(3)(A). 267 Id. § 1030(c)(1)(A). 268 Id. § 1030(c)(1)(B). 269 Id. § 1030(c)(2)(B). 270 Id. § 1030(c)(4)(E)–(F). 271 See generally CRS Report R41696, How the Federal Sentencing Guidelines Work: An Overview, by Charles Doyle. 272 18 U.S.C. § 3559(a). 273 Id. § 3571. 274 Id. 275 Id. § 3559(a)(6). 276 Id. § 3571(b)(5), (c)(5), (d). Congressional Research Service 26 Cybercrime and the Law: Primer on the Computer Fraud and Abuse Act Subsequent Offense*** Section* Description First Offense** 1030(a)(5)(B) Intentional Access + Reckless Damage to Computer 1 Year (M); 5 Years (F) 20 Years 1030(a)(5)(C) Intentional Access + Damage to Computer + Loss 1 Year 10 Years 1030(a)(6) Password Trafficking 1 Year 10 Years 1030(a)(7) Threats and Extortion 5 Years 10 Years Source: 18 U.S.C. § 1030(c). Notes: * Bolded subsection authorizes additional penalties beyond those reflected in this Table where there are certain aggravating factors such as causing death, broken down in further detail in Table 3. ** (M) denotes misdemeanor; (F) denotes felony. CFAA subsections that may be charged as a misdemeanor or a felony are broken down in further detail in Table 2, Table 3, and Table 4. *** Subsequent offense refers to maximum penalties possible for offense committed following conviction for another CFAA offense. Table 2. Overview of Maximum Penalties Under 18 U.S.C. § 1030(a)(2) Maximum Prison Terms for Obtaining Information by Unauthorized Computer Access Description of Offense Under § 1030(a)(2) Classification Sentence First Offense (No Special Conditions) Misdemeanor 1 Year Offense with One of Three Special Conditions: 1. Offense committed for purpose of commercial advantage or private financial gain; 2. Offense committed in furtherance of any criminal or tortious act in violation of the Constitution or state or federal law; or 3. The value of the information obtained is greater than $5,000. Felony 5 Years Subsequent Offense* Felony 10 Years Source: 18 U.S.C. § 1030(c)(2)(C). Note: * Subsequent offense refers to maximum penalties possible for offense committed following conviction for another CFAA offense. Table 3. Overview of Maximum Penalties Under 18 U.S.C. § 1030(a)(5)(A) Maximum Prison Terms for Knowing Transmission + Intentional Damage to a Computer Description of Offense Under § 1030(a)(5)(A) First Offense (No Special Harms) Congressional Research Service Classifica [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/crs%3AR47557. Public record. Not legal advice.