Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act is a United States federal law that criminalizes unauthorized access to computers and certain related conduct. Enacted in 1986, it also provides civil remedies for some violations.

Unauthorized access: Access to a computer or system without permission or beyond permission granted. The statute’s central concept, though courts have disputed what exceeding authorized access means.
Counterfeit Access Device and Computer Fraud and Abuse Act of 1984: A 1984 federal statute that established early criminal prohibitions on certain computer intrusions. It was the direct legislative predecessor to the 1986 Act.
Van Buren v. United States: A 2021 Supreme Court case narrowing the CFAA’s phrase “exceeds authorized access.” The Court rejected treating improper purposes alone as unauthorized access.
Stored Communications Act: A United States federal law governing unauthorized access to stored electronic communications and related records. It protects stored communications, while the CFAA primarily addresses computer access and damage.
Responsible disclosure: A practice in which security researchers report vulnerabilities privately so they can be fixed before public release. Uncertainty about CFAA liability can influence how researchers disclose discovered flaws.
Exceeds authorized access: A statutory phrase for accessing parts of a computer that a user is not entitled to access. Its interpretation shapes whether misuse of permitted access can violate the Act.
Computer Fraud and Abuse Act Amendments of 1986: The 1986 legislation that recast and broadened federal computer-fraud provisions. These amendments gave the statute its modern name and expanded its reach.
United States v. Nosal: A Ninth Circuit case holding that violating a computer-use policy alone does not necessarily violate the CFAA. It resisted an expansive reading that would turn ordinary policy breaches into federal crimes.
Digital Millennium Copyright Act: A United States law addressing copyright in digital works and circumvention of access controls. Circumvention can implicate the DMCA even when the CFAA’s access rules do not apply.
Security research: The systematic study of computer systems to identify vulnerabilities and improve security. The statute’s uncertain boundaries have shaped debate over legitimate vulnerability testing.

Linked from 9 pages