DecipherU
Sign inStart practicing

Computer Fraud and Abuse Act

US FederalGeneral Cybersecurity1986
ByDecipherU Editorial

The CFAA is the primary US federal cybersecurity criminal statute. It criminalizes unauthorized access to computer systems and exceeding authorized access. The Supreme Court's 2021 Van Buren decision narrowed its scope, ruling that 'exceeds authorized access' covers accessing data someone is not entitled to view, not misusing data they are authorized to access.

Quick Reference

EnactedOctober 16, 1986
Last Amended2008 (Identity Theft Enforcement and Restitution Act); interpreted by Van Buren v. United States, 593 U.S. 374 (2021)
Enforcement BodyDepartment of Justice (DOJ), FBI
PenaltiesFirst offense: up to 5 years imprisonment for unauthorized access; up to 10 years for repeat offenses; up to 20 years for certain aggravating factors
Applicable ToAnyone accessing a protected computer without authorization or exceeding authorized access

Key Requirements

18 U.S.C. § 1030(a)(2)

Prohibits knowingly accessing a protected computer without authorization to obtain information

18 U.S.C. § 1030(a)(5)

Prohibits knowingly causing damage to a protected computer through transmission of code, programs, or commands

18 U.S.C. § 1030(a)(7)

Prohibits extortion involving threats to damage a computer or expose stolen data (covers ransomware)

18 U.S.C. § 1030(g)

Provides a civil cause of action for any person who suffers damage or loss due to CFAA violations

How Does CFAA Affect Cybersecurity Careers?

Penetration testers must obtain proper written authorization to avoid CFAA liability. Security researchers navigating vulnerability disclosure must understand CFAA boundaries. Digital forensics analysts and incident responders work with law enforcement under CFAA investigations.

Cybersecurity Roles That Work With CFAA

Penetration Tester→Incident Responder→

Related Cybersecurity Certifications

OSCPCEHCISSP

Related Cybersecurity Laws

Electronic Communications Privacy Act→USA PATRIOT Act (Cybersecurity Provisions)→

Read the full text of CFAA at the official source: https://www.law.cornell.edu/uscode/text/18/1030

Frequently Asked Questions

The CFAA is the primary US federal cybersecurity criminal statute. It criminalizes unauthorized access to computer systems and exceeding authorized access. The Supreme Court's 2021 Van Buren decision narrowed its scope, ruling that 'exceeds authorized access' covers accessing data someone is not entitled to view, not misusing data they are authorized to access.

Penetration testers must obtain proper written authorization to avoid CFAA liability. Security researchers navigating vulnerability disclosure must understand CFAA boundaries. Digital forensics analysts and incident responders work with law enforcement under CFAA investigations.

First offense: up to 5 years imprisonment for unauthorized access; up to 10 years for repeat offenses; up to 20 years for certain aggravating factors

Sources

  1. Official text: CFAA
Last verified: April 2026?Report an inaccuracy

Explore Related Cybersecurity Resources

Career GuidePenetration Tester cybersecurity career guideRead the full career guide for Penetration Tester rolesCareer GuideIncident Responder cybersecurity career guideRead the full career guide for Incident Responder rolesCertificationOscp cybersecurity certification guideCost, exam format, and career impact detailsLawEcpa cybersecurity law summaryRequirements, penalties, and career impact

Was this page helpful?

Cybersecurity law and regulation summaries are educational plain-language descriptions, not legal advice. Statutes, regulations, and enforcement guidance change frequently. Consult qualified legal counsel and verify against the official published text before relying on any summary for compliance or career decisions.