The CFAA Has Come a Long Way, or Has It?

This panel examines the Computer Fraud and Abuse Act, the decades-old federal hacking statute, and why its central phrases, unauthorized access and exceeding authorized access, were never defined in the text. The speakers, a federal prosecutor, an FBI cyber agent and a former FBI supervisor who is now a lawyer, explain how Supreme Court rulings have narrowed the law and how Justice Department guidelines issued in May now direct prosecutors to decline cases involving good-faith security research carried out to avoid harm.

The middle of the session focuses on what the guidance does and does not change. The prosecutor stresses that the guidelines are internal policy that cannot be enforced in court and do not alter the statute, while the agents say their caseload is dominated by ransomware and other serious intrusions. The panelists then work through two hypotheticals: an incident response team that uses stolen cloud storage credentials to reach its data and deletes other victims' files, and a researcher who rushes out a patch for a wormable flaw. They weigh criminal exposure, civil liability and the risk of unintended damage, especially in hospitals and other systems that are hard to patch.

The takeaway is that the guidance signals priorities rather than rewriting the law, so teams should bring in law enforcement before acting on stolen data and document their intent and the care they took. Audience questions raised whether Congress should add a public-interest defense and how the Aaron Swartz case would be treated today, and the panel offered no firm answer on either. Responsible disclosure remains a matter of ethics and practice rather than statute.