Computer Fraud and Abuse Act
The primary federal anti-hacking statute that prohibits accessing a computer without authorization or exceeding authorized access. The law applies to federal computers, financial institutions, and computers used in interstate and foreign commerce, establishing both criminal penalties and a civil cause of action for intentional unauthorized access.
| Jurisdiction | United States |
|---|---|
| Category | Cybersecurity |
| Status | Active |
| Latest development |
Analysis
Key Requirements
The Computer Fraud and Abuse Act (CFAA) establishes several key requirements:
- Prohibits unauthorized access to protected computers, including federal government systems, financial institutions, and computers used in interstate commerce
- Criminalizes exceeding authorized access to obtain or alter information
- Prohibits knowingly transmitting malicious code to intentionally damage protected computers
- Outlaws trafficking in passwords or access codes for unauthorized computer access
- Establishes both criminal penalties and a civil cause of action for violations
- Requires proving the defendant knowingly accessed a computer without or in excess of authorization
Compliance Challenges
Organizations face several challenges in complying with the CFAA:
- Defining "authorized access" for employees and third parties, as highlighted in the Van Buren v. United States Supreme Court case
- Implementing technical controls to prevent and detect unauthorized access, according to NIST cybersecurity guidelines
- Balancing security with usability and productivity, as noted in industry analyses
- Keeping up with evolving cyber threats and attack methods, as outlined in the Verizon Data Breach Investigations Report
- Properly scoping internal investigations to avoid exceeding authorization, per DOJ guidance
Implementation Best Practices
To implement CFAA compliance, organizations should:
- Develop clear acceptable use policies defining authorized access, as recommended by NIST Special Publication 800-53
- Implement principle of least privilege access controls
- Use multi-factor authentication for sensitive systems
- Conduct regular security awareness training for employees
- Perform periodic access reviews to ensure appropriate authorization
- Implement logging and monitoring to detect potential violations
Tools and resources:
Recent Updates
Recent updates to the CFAA include:
- Supreme Court ruling in Van Buren v. United States (June 2021) narrowing the interpretation of "exceeds authorized access"
- DOJ policy update (May 2022) limiting prosecutions for good faith security research
- Proposed CFAA Reform Act (February 2022) to clarify definitions and limit scope
Organizations should review these updates and adjust policies accordingly, with compliance expected immediately for DOJ policy changes.
Related Regulations
The CFAA interacts with several related regulations:
- Electronic Communications Privacy Act (ECPA) - Overlaps on unauthorized access to electronic communications
- Stored Communications Act (SCA) - Addresses unauthorized access to stored electronic communications
- Economic Espionage Act - Covers theft of trade secrets, which may involve computer intrusion
- Digital Millennium Copyright Act (DMCA) - Prohibits circumvention of technological protection measures
- State computer crime laws - May have additional or stricter requirements
Organizations should ensure compliance with all relevant regulations in addition to the CFAA.
Industry Impact
The CFAA has significant impacts across industries:
- Technology sector: Affects security research and bug bounty programs, requiring careful scoping
- Financial services: Imposes strict requirements on protecting customer data and financial systems
- Healthcare: Intersects with HIPAA requirements on protecting patient information
- Government contractors: Face enhanced penalties for violations involving federal systems
- Cybersecurity industry: Shapes penetration testing and incident response practices
Organizations should assess their specific industry requirements and risks related to CFAA compliance.
Sources
- 18 U.S.C. § 1030 - Computer Fraud and Abuse Act
- DOJ Criminal Resource Manual on CFAA
- NIST Special Publication 800-53
- Supreme Court: Van Buren v. United States
- DOJ Policy on CFAA Prosecutions
- CFAA Reform Act Bill Text
- NIST Cybersecurity Framework
- CIS Critical Security Controls
- MITRE ATT&CK Framework
- Electronic Communications Privacy Act
- Stored Communications Act
- Economic Espionage Act
- Digital Millennium Copyright Act
- State Computer Crime Laws
- EFF on DOJ CFAA Policy
- FFIEC Cybersecurity Guidance
- HHS HIPAA Security Rule
- FAR Clause on Basic Safeguarding
- PCI Penetration Testing Guidance
Recent developments
- — The U.S. Court of Appeals for the Third Circuit clarified that violating workplace computer-use policies alone does not amount to a CFAA violation absent evidence of hacking or trade secret misuse. The decision is being cited as narrowing the statute’s reach in employee-access disputes.[6] (source)
- — The Department of Justice announced a revised charging policy for CFAA cases, directing prosecutors not to charge good-faith security research under the statute. The policy also requires consultation with CCIPS and, in some cases, approval from the Deputy Attorney General before filing charges.[7] (source)
- — The Justice Manual explains that CFAA charges require proof that a defendant knowingly accessed a computer or area of a computer they were not allowed to access. It emphasizes that misuse of information alone is not enough without unauthorized access.[2] (source)
- — Legal commentary after Van Buren continues to stress that purpose-based access restrictions generally do not create CFAA liability. The article describes the ruling as eliminating a major path to prosecution and bringing clarity to employer-policy cases.[4] (source)
- — The Supreme Court’s Van Buren decision remains a key reference point for CFAA interpretation, holding that “exceeds authorized access” does not cover using otherwise permitted access for an improper purpose. That ruling continues to shape later DOJ policy and lower-court analysis.[3] (source)
- — NACDL’s CFAA overview summarizes the statute’s core provisions and penalties, reflecting continued practitioner attention to how the law is applied across hacking, password trafficking, and damage cases. This is a reference resource rather than a new policy change.[1] (source)
- — CBS News’ coverage of the Supreme Court’s CFAA ruling highlights the broader industry impact: the decision narrowed federal computer-fraud exposure for conduct involving improper motives but otherwise authorized access. The ruling is often discussed in cybersecurity and workplace-access disputes.[8] (source)
- — JD Supra’s CFAA coverage notes that courts have continued to limit CFAA claims in web-scraping and public-access contexts, including decisions finding that scraping publicly accessible sites does not necessarily violate the statute. This has been important for data, platform, and security-industry stakeholders.[9] (source)
Read the full guide to Computer Fraud and Abuse Act
Related regulations
- NIST AI Risk Management Framework (AI RMF 1.0) — United States, Active, effective 2023-01-26
- Blueprint for an AI Bill of Rights — United States, Active
- COPPA (Children's Online Privacy Protection Act) — United States, Active
- Cybersecurity Maturity Model Certification — United States, Phased, effective 2025-11-10
- SEC Cybersecurity Disclosure Rules — United States, Active, effective 2023-12-18
- Executive Order 14365 - Ensuring a National Policy Framework for Artificial Intelligence — United States, Active, effective 2025-12-11
- TAKE IT DOWN Act — United States, Active, effective 2026-05-19
- SEC Regulation S-P Amendments (Customer Data Incident Response) — United States, Active, effective 2026-06-03
Put it into practice
- Generate the policy: NIST CSF policy generator (generatepolicy.com)
- Buy the policy pack: Enterprise Security Bundle (cyberpolicy.shop)
- Build it yourself: Compliance Program Starter (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates