United States. Cybersecurity. Act
CFAAComputer Fraud and Abuse Act of 1986 (18 U.S.C. § 1030)
Partly verified
Medium confidence.Source read: Wikipedia only. Penalty levels not given in the source so left empty. Effective date not stated. In force date: the Act (Pub. L. 99-474, read in the Statutes at Large at congress.gov) contains no effective-date clause, and LII has no effective-date note for it, so the enactment date of 16 Oct 1986 is used by default. Penalties per 18 U.S.C. 1030(c) on LII range from 1 year to 20 years depending on the offence; civil action under 1030(g) must be filed within 2 years.
§1Summary
- Synopsis
Criminalises unauthorised access to protected computers and creates a private civil right of action for people harmed. In Van Buren v. United States (2021) the Supreme Court held that 'exceeds authorized access' does not cover someone who uses information they were entitled to access for an improper purpose.
- Key themes
- Unique features
Both a criminal statute and a basis for private suits; the scope of 'authorized access' has been narrowed by the courts.
- SaaS relevance
Basis for action against hacking and scraping of SaaS systems; informs security-research risk.
§2Obligations
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Imprisonment from up to 1 year up to 20 years (or life where death results) depending on the offence; civil damages and equitable relief under 18 U.S.C. 1030(g)
§3Dates
- Key dates
- Adopted
- In force
- Pub. L. 99-474 signed 16 Oct 1986. Amended 1989, 1994, 1996, 2001 (USA PATRIOT Act), 2002 and 2008 (Identity Theft Enforcement and Restitution Act). Van Buren v. United States decided June 2021.
§4Text and authority
- Text
- Authoritative text law.cornell.edu
- Authority
- US Department of Justice; federal courts
§5Where it applies
- Domestic law of
- United States
- Also applies in
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Guam
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Puerto Rico
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- US Virgin Islands
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Source read: Wikipedia only. Penalty levels not given in the source so left empty. Effective date not stated. In force date: the Act (Pub. L. 99-474, read in the Statutes at Large at congress.gov) contains no effective-date clause, and LII has no effective-date note for it, so the enactment date of 16 Oct 1986 is used by default. Penalties per 18 U.S.C. 1030(c) on LII range from 1 year to 20 years depending on the offence; civil action under 1030(g) must be filed within 2 years.