Computer Fraud and Abuse Act: A Failed and Flawed Law
This paper examines the Computer Fraud and Abuse Act (CFAA), passed by Congress in 1984 to protect federal computers and information systems from unauthorized access and damage. The essay argues that despite its legitimate initial purpose, the law has been increasingly misused by prosecutors to target minor violations of terms-of-service agreements and conduct causing no material harm. The paper traces the statute's expansion over time, analyzes its inadequacies—particularly vague definitions and disproportionate penalties—and reviews a case study of Aaron Swartz to illustrate its dangers. The paper concludes that substantial reform or replacement of the CFAA is necessary to ensure justice and that the rule of law, rather than judicial discretion, governs prosecutions.
- Introduction: CFAA's original purpose and expansion over time
- Background and Legislative Intent: Original scope, whistleblower protections, terms-of-service violations
- Inadequacies of the CFAA: Vague definitions, disproportionate penalties, scope creep
- Limited Adequacies: Law's appropriateness in original limited context
- Proposed Changes and Judicial Response: DOJ policy reform and rule of lenity resistance
- Conclusion: Judicial checks and need for statutory reform
✍️ How to write this paper — guide, tools & examples ▾
What makes this paper effective
- Establishes clear argumentative position early and sustains it throughout: the CFAA, though well-intentioned, has become a tool for unjust prosecution of minor offenses.
- Uses concrete case studies (Aaron Swartz, Matthew Keys) to humanize abstract legal problems and demonstrate real-world harm.
- Acknowledges complexity by including a section on "Adequacies"—showing the law had merit in its original context—which strengthens credibility before critiquing it.
- Integrates scholarly sources (Timothy Wu, Charles Doyle) to ground legal and policy analysis in authoritative voices.
Key academic technique demonstrated
This paper employs structured legal critique: it establishes legislative history and original intent, documents how practice has diverged from intent, catalogs specific inadequacies (vague language, harsh penalties), and proposes reform. The author also uses the technique of concession—acknowledging that the law originally served a purpose—to avoid appearing dismissive and to strengthen the argument that expansion, not the original statute, is the problem.
Structure breakdown
The paper follows a classic problem-solution structure. The introduction defines the CFAA and signals its misuse. The background section contextualizes the law's original scope and notes early congressional awareness of misuse risks. The "Inadequacies" section forms the argumentative core, detailing three main problems: vague definitions, harsh penalties, and scope creep. The brief "Adequacies" section concedes the law's original utility. The final sections present proposed reforms and note emerging judicial resistance through the rule of lenity. This architecture moves from definition to critique to remedy, building a persuasive case for reform.
Introduction
Technology has changed faster than the laws designed to protect the public. Protecting information, particularly sensitive government information, posed unique regulatory challenges. With this in mind, Congress passed the Computer Fraud and Abuse Act in 1984. The CFAA "outlaws conduct that victimizes computer systems. It is a cyber-security law. It protects federal computers, bank computers, and computers connected to the Internet. It shields them from trespassing, threats, damage, espionage, and from being corruptly used as instruments of fraud" (Doyle, 2014, pp. 1–2). The CFAA's provisions ban unauthorized access to data; the damaging of or use of threats to damage data; or trafficking in passwords and other sensitive data from a wide range of computers containing protected information (Doyle, 2014, pp. 1–2).
The law was passed during the pre-Internet era "as a narrow statute enacted for the reasonable goal of combating malicious hackers: people who break into computer systems and steal valuable data (like credit-card numbers) or do real economic damage" (Wu, 2013). However, because of the vague wording of the law, it has been increasingly deployed by prosecutors in a much wider range of cases in a manner that makes many legal scholars profoundly uncomfortable (Wu, 2013). "Over the years, Congress expanded the statute five times, adding private rights of action and making misdemeanors into felonies. Both private litigants and the Justice Department began to use the law against not only hackers but also otherwise legitimate users who violate the 'terms of service' policies that come with nearly every piece of software and service we use on computers today" (Wu, 2013). Thus, the original intention and spirit of the law have been violated, and unnecessary amounts of time and energy are being diverted to prosecute relatively minor offenses.
Create your account
Always verify citation format against your institution’s current style guide requirements.