The Computer Fraud and Abuse Act (CFAA) is a federal statute that provides for not only criminal liability, but also civil liability, when a person accesses a computer “without authorization” or “exceeding authorized access.” However, as a result of differing opinions among federal circuit courts, the scope of actionable conduct under the CFAA remains unclear. And due to high-profile cases like United States v. Nosal and Facebook v. Power Ventures, the CFAA has recently drawn increased attention from practitioners and scholars alike—often hoping for the Supreme Court to end the lack of clarity under the statute. This has not yet happened. Nevertheless, this attention has led to the issue of when and how can password sharing be subject to criminal (and civil) liability.
The CFAA’s Muddy Waters
There has been much debate and consternation over what the phrase “exceed authorized access” in the CFAA means. Numerous articles have addressed this issue and the circuit split concerning this issue. Nonetheless, some of this attention and analysis has been misplaced.
