Unauthorised computer access law in the US, the CFAA explained

The US federal Computer Fraud and Abuse Act (CFAA), at 18 U.S.C. 1030, covers anyone who "intentionally accesses a computer without authorization or exceeds authorized access" and thereby obtains certain information. In 2021 the Supreme Court decided what "exceeds authorized access" means.

This page is general information, not legal advice. For a real case, speak to a lawyer.

What does 18 U.S.C. 1030(a)(2) say?

Section 1030(a)(2) applies to whoever "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains" any of three kinds of information:

1. information in a financial record of a financial institution or card issuer, or in a consumer reporting agency's file on a consumer;
2. "information from any department or agency of the United States"; or
3. "information from any protected computer".

The third item is the broadest. Section 1030(e)(2)(B) defines a protected computer to include one "which is used in or affecting interstate or foreign commerce or communication".

Section 1030 also contains other offences, such as those about damage to computers and trafficking in passwords. This page covers access and obtaining information.

What does "exceeds authorized access" mean?

The statute defines it in section 1030(e)(6): "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter".

So there are two routes into section 1030(a)(2): access "without authorization", and exceeding authorized access. The Supreme Court's 2021 opinion, below, reads them together: "one either can or cannot access a computer system, and one either can or cannot access certain areas within the system."

What did the Supreme Court decide in Van Buren?

Van Buren v. United States was decided on 3 June 2021, by six votes to three. Justice Barrett wrote the opinion of the Court.

The facts, as the opinion gives them: "Nathan Van Buren, a former police sergeant, ran a license-plate search in a law enforcement computer database in exchange for money." His department's policy allowed database searches only for law enforcement purposes.

The Court held that an individual "exceeds authorized access" when he "accesses a computer with authorization but then obtains information located in particular areas of the computer", giving the examples "such as files, folders, or databases", that are "off limits to him."

Applying that, the Court said Van Buren could use the system to retrieve licence plate information, so he did not exceed authorized access "even though he obtained information from the database for an improper purpose." The Court reversed the lower court's decision.

The opinion calls this "a gates-up-or-down inquiry".

Does a workplace policy decide what you're entitled to?

The Supreme Court left part of that open. In footnote 8 of the opinion, it said: "For present purposes, we need not address whether this inquiry turns only on technological (or 'code-based') limitations on access, or instead also looks to limits contained in contracts or policies."

So the opinion settles that purpose alone is not the test. It does not settle whether a written policy, as opposed to a technical barrier such as a password or permission setting, can mark an area as off limits.

What are the penalties?

Section 1030(c) sets them. For a first offence under subsection (a)(2), the punishment is "a fine under this title or imprisonment for not more than one year, or both".

The maximum rises to five years for an (a)(2) offence if any of the conditions in section 1030(c)(2)(B) applies:

• "the offense was committed for purposes of commercial advantage or private financial gain";
• it was committed in furtherance of any criminal or tortious act under federal or state law; or
• "the value of the information obtained exceeds $5,000".

A repeat (a)(2) offence, after a conviction for another offence under the section, carries up to ten years.

Can someone bring a civil claim?

Section 1030(g) allows one: "Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief."

It adds a condition. A civil action "may be brought only if the conduct involves" one of the factors listed in section 1030(c)(4)(A)(i), and the statute sets further limits on damages and timing.

More questions

Is it illegal to access someone's computer without permission in the US?

Section 1030(a)(2) covers whoever intentionally accesses a computer without authorization or exceeds authorized access and thereby obtains information of the kinds it lists. Whether any particular situation meets that is a matter for the facts and the courts. For a real case, speak to a lawyer.

What is the CFAA in simple terms?

It is the federal Computer Fraud and Abuse Act of 1986, codified at 18 U.S.C. 1030. Its access offence in subsection (a)(2) is about intentionally getting into a computer without authorization, or going beyond authorized access, and obtaining information.

Did Van Buren make misusing work access legal?

It decided a narrower question. The Court held that obtaining information you are entitled to obtain, for an improper purpose, is not exceeding authorized access under the CFAA. It didn't decide whether limits in contracts or policies count.

Does this page cover state law?

No. It covers the federal statute, 18 U.S.C. 1030, and the Supreme Court's reading of it in Van Buren. For a real case, speak to a lawyer.

Where is the UK version of this law?

In the UK, the equivalent offence is in section 1 of the Computer Misuse Act 1990. See is it illegal to access someone's computer in the UK.

Sources

• 18 U.S. Code 1030, Fraud and related activity in connection with computers, Legal Information Institute, Cornell Law School
• Van Buren v. United States, No. 19-783 (2021), Supreme Court of the United States