Computer Fraud and Abuse Act (CFAA)

What is considered a protected computer under the CFAA?

• Any computer that can connect to the internet

In the CFAA, what is considered exceeding authorized access?

• Intentionally getting information that is restricted

• Covers all computers

• You can have permission to access the computer, just not to that info

What is included under the protected computer clause?

• Info comes from financial institution, federal government, or a protected computer

• Reading off the screen counts as obtaining information

What is the third clause of the CFAA?

• Trespassing in a government computer is prohibited

• Don’t have to do anything but have the device

• Intention doesn’t matter

What is the idea behind the “intent to defraud” clause of the CFAA?

• You are not allowed to create deceptive apps or schemes that can be used to gain money

• Anti fraud provision

• The fraud has to be directly linked to the computer

• You are not allowed to create or spread viruses/do damage to protected computers

• You are not allowed to exceed access

  • if you exceed access, intention doesn’t matter! still a punishable offense

What does the “intent to defraud traffics” clause state?

• You are not allowed to transfer personal information like passwords to another device

• Applies to all protected computers

• Don’t have to gain → participation is punishable

• Prevents extortion or threats of it on protected computers

• Threat types include:

  • cause damage → emotionally, physically, etc

  • to gain or expose confidential info

  • export payment

What counts as exceeding access?

Using the computer/account to do more than what was previously agreed upon