Cybercrime and hacking are much in the news recently, and the recent wave of ransomware attacks reminds us of how our dependence on heavily networked and interconnected systems can leave even our most critical infrastructure vulnerable to attack. Numerous federal and state statutes seek to provide protection against this kind of activity, but even leaving aside enforcement issues (which can be substantial, particularly for conduct that originates outside the United States) courts have struggled to interpret the precise scope of these laws. While most people have some idea of what “computer hacking” is, defining it with the specificity necessary to impose criminal liability has sometimes turned out to be a challenge.
For example, most federal criminal prosecutions for “hacking” (as that term is generally understood) are brought under the Computer Fraud and Abuse Act (the CFAA), 18 U.S.C. §1030, which covers a broad range of misconduct relating to networked computer systems. Violations of the CFAA can lead to both civil and criminal liability, so the statute attempts to draw bright lines defining its scope. Nonetheless, the courts within the Federal Circuit have disagreed substantially about what conduct the statute actually prohibits—at least at the margins.