CFAA

Who it applies to

Anyone accessing 'protected computers', which covers essentially any computer used in or affecting interstate or foreign commerce.

Key requirements

• Prohibits accessing a computer without authorisation or exceeding authorised access to obtain information.
• Prohibits knowingly causing damage, for example by transmitting malware.
• Prohibits trafficking in passwords and extortion involving computers.
• Allows civil actions by victims who suffer qualifying loss or damage.
• The Supreme Court's Van Buren decision (2021) narrowed what 'exceeds authorized access' means.

Breach and incident notification

Not a notification law. State breach notification laws and sector rules cover disclosure.

Penalties

Criminal fines and imprisonment that scale with the offence and prior convictions, plus civil damages.

Go deeper