Computer Fraud and Abuse Act A failed and flawed law

Technology has changed faster than the laws that exist to protect the public. Protecting information, particularly sensitive government information, was thought to be challenging and to pose additional dilemmas in terms of its regulation. With this in mind, Congress passed the Computer Fraud and Abuse Act in 1984. The CFAA "outlaws conduct that victimizes computer systems. It is a cyber-security law. It protects federal computers, bank computers, and computers connected to the Internet. It shields them from trespassing, threats, damage, espionage, and from being corruptly used as instruments of fraud" (Doyle 2014:1-2). The CFAA's provisions ban the trespassing of data; the damaging of or use of threats to damage data; or trafficking in the passwords and other sensitive data of a wide range of computers containing protected information (Doyle 2014:1-2).

The law was passed during the pre-Internet era "as a narrow statute enacted for the reasonable goal of combating malicious hackers: people who break into computer systems and steal valuable data (like credit-card numbers) or do real economic damage" (Wu 2013). However, because of the vague wording of the law, it has been increasingly deployed by prosecutors in a much wider range of cases in a manner that makes many legal scholars profoundly uncomfortable (Wu 2013). "Over the years, Congress expanded the statute five times, adding private rights of action and making misdemeanors into felonies. Both private litigants and the Justice Department began to use the law against not only hackers but also otherwise legitimate users who violate the 'terms of service policies that come with nearly every piece of software and service we use on computers today" (Wu 2013). Thus, the original intention and spirt of the law has been violated and needless amounts of time and energy...

Thus the law does not "criminalize acts in which the offending employee merely 'exceeds authorized access to computers in his own department'" (Doyle 2014: 4). The law is limited in scope to those who are not entitled to access government computers or who engage in interdepartmental trespass. But other concerns have arisen regarding outside unauthorized use that may technically violate 'terms of service' agreements (which arguably are written in such a lengthy and confusing manner they are impossible for a user to truly agree to when he or she clicks a button). For example, Aaron Swartz was threatened with thirty-five years in prison because of violating terms-of-service by downloading too many academic articles as an authorized guest on the MIT network (Wu 2013). Swartz, terrified in the face of the upcoming prosecution, committed suicide as a result.
Inadequacies

The law has been heavily criticized by a number of groups, including civil libertarian organizations. The notion of "without authorization" is not clearly defined and while the statute does define "exceeds authorized access," there is concern that "the meaning of that phrase has been subject to considerable dispute" in the courts and is not consistently enforced ("The Computer Fraud and Abuse Act reform," 2014). The law has also been criticized for excessively harsh penalties. "Compounding this problem is the CFAA's disproportionately harsh penalty scheme. Even first-time offenses for accessing a protected computer without sufficient 'authorization' can be punishable by up to five years…