Computer Fraud And Abuse Act (Cfaa) Prosecutions
🔍 Overview of the Computer Fraud and Abuse Act (CFAA)
The Computer Fraud and Abuse Act (CFAA), enacted in 1986 and amended several times, is a key federal statute in the U.S. used to prosecute a wide range of computer-related crimes, including:
Unauthorized access to computers or networks
Hacking and data breaches
Fraud and theft involving computer systems
Trafficking passwords or access information
Damage to protected computers (government, financial institutions, etc.)
The CFAA prohibits accessing a computer “without authorization” or “exceeding authorized access” and causing damage or obtaining information.
⚖️ Landmark CFAA Prosecution Cases
1. United States v. Aaron Swartz (2013)
Facts: Aaron Swartz, a computer programmer and activist, downloaded millions of academic articles from JSTOR through MIT’s network, allegedly bypassing restrictions.
Legal Issues: Violations of CFAA for unauthorized access and data theft.
Ruling: Swartz was indicted but tragically died by suicide before trial. The case sparked debates over CFAA’s scope and harsh penalties.
Significance: Raised questions about “exceeding authorized access” and led to calls for reforming CFAA.
2. United States v. Lori Drew (2008)
Facts: Lori Drew created a fake MySpace profile to harass a teenager who later committed suicide.
Legal Issues: Whether violating a website’s terms of service constitutes a CFAA violation.
Ruling: Initially convicted, but conviction overturned on appeal as exceeding terms of service was deemed insufficient to violate CFAA.
Significance: Highlighted limits of CFAA regarding website terms of service violations.
3. United States v. Nosal (2012)
Facts: David Nosal, a former employee of an executive search firm, encouraged others to access the company’s confidential database after he left.
Legal Issues: Whether employees who access data for unauthorized purposes violate CFAA.
Ruling: Court held that violating employer’s use policies alone does not constitute CFAA violation unless access is unauthorized.
Significance: Clarified “exceeding authorized access” scope, limiting CFAA’s reach.
4. United States v. Andrew Auernheimer (2014)
Facts: Auernheimer accessed AT&T’s website to collect email addresses of iPad users by exploiting a security flaw.
Legal Issues: Whether accessing publicly available information using an automated script violated CFAA.
Ruling: Initially convicted, but conviction overturned on jurisdictional grounds.
Significance: Raised issues about what constitutes unauthorized access when data is publicly available.
5. United States v. Matthew Keys (2013)
Facts: Keys, a former Reuters employee, allegedly gave hackers login credentials to access and deface the Los Angeles Times website.
Legal Issues: Unauthorized access and conspiracy under CFAA.
Ruling: Convicted and sentenced to 2 years in prison.
Significance: Demonstrated CFAA application in insider-related cyber sabotage.
6. United States v. Jeremy Hammond (2013)
Facts: Hammond hacked into the private intelligence firm Stratfor, leaking sensitive information online.
Legal Issues: Unauthorized access, theft of information under CFAA.
Ruling: Pleaded guilty; sentenced to 10 years.
Significance: High-profile hacktivism prosecution under CFAA.
7. United States v. Kevin Mitnick (1999)
Facts: Mitnick was one of the most notorious hackers, charged with multiple unauthorized intrusions into computer systems, including corporate and government.
Legal Issues: Computer fraud, wire fraud under CFAA.
Ruling: Pleaded guilty; sentenced to 5 years in prison.
Significance: Landmark case that brought national attention to computer hacking crimes and CFAA enforcement.
🧠 Legal Themes in CFAA Prosecutions
| Theme | Explanation |
|---|---|
| Unauthorized Access | Core CFAA element—accessing a computer without permission or exceeding authorized use. |
| Terms of Service Limits | Courts often distinguish between violating website terms and unauthorized access. |
| Insider Threats | Employees or insiders accessing data beyond permission may be prosecuted under CFAA. |
| Automated Data Collection | Using scripts or bots to scrape data can trigger CFAA if deemed unauthorized. |
| Damage or Theft | Causing damage or stealing data escalates penalties. |
| Jurisdictional Issues | Cases sometimes dismissed on venue or jurisdiction grounds. |
✅ Summary
The CFAA is a powerful tool for prosecuting cybercrimes but has faced criticism for overly broad language. Courts have increasingly limited CFAA’s reach, especially concerning terms of service violations and insider misuse. Cases like Aaron Swartz and Lori Drew sparked important debates about balancing cybersecurity and civil liberties.
RELATED Blog
0 comments