Eject the Floppy Disk: How to Modernize the Computer Fraud and Abuse Act to Meet Cybersecurity Needs

Abstract

When people think of computer hacking, they tend to think of some fictional character sitting in their parent’s basement while they try to take down some website through various “evil” coding methods. Hacking, as covered by the Computer Fraud and Abuse Act (CFAA), is actually much more prevalent and could mean serious prison time for unsuspecting employees. The CFAA is a federal law that both criminalizes and holds people civilly liable when they “exceed[] authorized access.” Due to poor drafting, circuits split on whether to read that language broadly and or narrowly, meaning some defendants walk free while others face up to ten years in prison. I argue the Supreme Court should grant certiorari in Nosal v. United States, and should adopt a broad interpretation of the CFAA to hold people accountable for when they violate the intended-use of information. I make two suggestions on how to modernize the CFAA to keep up with the current pace of cybersecurity law. Finally, I propose some steps employers can take now to protect their information in the interim.