What is the Computer Fraud and Abuse Act?
Photo courtesy Jochen Zick / Flickr Creative Commons
When you think of “computers,” the first thing that might come to mind is a desktop or a laptop. But computers are everywhere — from your smartphone to your tablet. Basically, anything crime involving a device that stores files, connects to the Internet and/or handles sensitive transactions is one that could fall under one or more various state and federal computer crimes statues.
The best known computer intrusion statute is the Computer Fraud and Abuse Act or CFAA. It’s the federal law used mainly to prosecute suspected hackers, but in recent years it’s been broadly applied to cases with very little resemblance of a traditional computer “hack.” You don’t need elite hacking skills or master knowledge of a database or system to be charged under the CFAA. A prosecutor only has to prove knowledge, intent, some kind of transmission (usually a command or code), damage and loss, or some combination of the five elements.
The CFAA (18 U.S.C. § 1030) covers two types of computer systems:
- Computers that are used by financial institutions like banks; the United States government; or any computer that is affected by or connected to a bank or government system
- Computers that are used in interstate or foreign commerce and/or communication. This can include computers located outside the United States that is used in a manner that affects interstate or foreign commerce and/or communication inside the United States.
While the first point is pretty narrow, the last point is extremely broad. In recent years, prosecutors have applied the CFAA mainly to computer incidents involving websites. They argue that when a website is compromised or forced offline through some act, it affects either commerce or communication because websites are inherently interstate — they’re available from state to state, and they are often visited by people living within and outside of a state.
The CFAA covers a number of computer-related offenses, including:
- Theft of trade secrets from businesses or other organizations;
- Computer hacking, data breaches and data leaks;
- Causing a website outage through a flood of fraudulent web traffic (Distribute Denial of Service, or DDoS, attacks);
- Trafficking in passwords to computers, websites or web services;
- Transmitting viruses through email, blogs, social networks or other means;
- Any kind of fraud connected to the Internet, including identity or email fraud;
- Phishing campaigns and attempted phishing campaigns.
For years, journalists, politicians and advocacy groups have highlighted the flaws with the broad nature of the CFAA, noting that it has been expanded to include charges for offenses that weren’t originally intended when it was passed in the mid-1980s. Nonetheless, lawmakers have strengthened the law over the past few decades, and it has become a prosecutor’s favorite tool for bringing criminal charges against ordinary people who may have — wittingly or unwittingly — violated the law.
A conviction under the CFAA could earn a person between 1 and 10 years in prison per offense or up to 20 years in prison for repeat offenses, as well as fines in the hundreds of thousands of dollars. Even worse, since the passage of the USA PATRIOT ACT, certain elements of the CFAA have been designated crimes deserving of the label “domestic terrorism.” This principally applies to crimes involving government or financial computer systems, but in theory it could be applied to any offense under the CFAA.
