Computer Fraud and Abuse Act: A Failed and Flawed Law
This paper examines the Computer Fraud and Abuse Act (CFAA), originally passed by Congress in 1984 to combat malicious hackers targeting government and financial computer systems. The paper traces how the law's vague language and successive expansions have allowed prosecutors to apply it far beyond its intended scope, criminalizing minor terms-of-service violations and threatening ordinary computer users with severe prison sentences. Drawing on legal scholarship and notable cases, the paper evaluates both the law's original rationale and its contemporary inadequacies, and concludes with proposed reforms including revised Justice Department enforcement policy and judicial application of the rule of lenity.
- Introduction: CFAA origins, scope, and prosecutorial overreach
- Background: Legislative history and early misuse concerns
- Inadequacies of the CFAA: Vague wording, harsh penalties, and unjust prosecutions
- Adequacies in Its Original Context: Law's narrow, reasonable purpose in pre-Internet era
- Proposed Changes: Reform options and Justice Department policy changes
- Conclusion: Judicial lenity offers hope; reform still urgently needed
✍️ How to write this paper — guide, tools & examples ▾
What makes this paper effective
- Uses concrete, high-profile cases — such as the Aaron Swartz prosecution and the Matthew Keys incident — to ground abstract legal criticism in real human consequences.
- Balances critique with acknowledgment of the law's original legitimacy, demonstrating intellectual fairness before arguing for reform.
- Draws on diverse, credible sources including a Congressional Research Service report, the Electronic Frontier Foundation, and legal commentary from a Columbia law professor.
Key academic technique demonstrated
The paper effectively uses the "concede and rebut" technique: it acknowledges that the CFAA served a reasonable purpose at its inception before systematically dismantling the justification for its current form. This rhetorical structure strengthens the reform argument by showing the author has considered the law on its own terms rather than dismissing it outright.
Structure breakdown
The paper follows a classic evaluative essay structure: an introduction establishing context and thesis, a background section providing legislative history, parallel sections weighing inadequacies against original adequacies, a proposed-changes section offering solutions, and a conclusion that synthesizes the argument and ends with a normative call to action. Each section builds logically on the last, moving from description to critique to reform.
Introduction
Technology has changed faster than the laws that exist to protect the public. Protecting information — particularly sensitive government information — was thought to be challenging and to pose additional dilemmas in terms of its regulation. With this in mind, Congress passed the Computer Fraud and Abuse Act in 1984. The CFAA "outlaws conduct that victimizes computer systems. It is a cybersecurity law. It protects federal computers, bank computers, and computers connected to the Internet. It shields them from trespassing, threats, damage, espionage, and from being corruptly used as instruments of fraud" (Doyle 2014: 1–2). The CFAA's provisions ban the trespassing of data, the damaging of or use of threats to damage data, and the trafficking of passwords and other sensitive data across a wide range of computers containing protected information (Doyle 2014: 1–2).
The law was passed during the pre-Internet era "as a narrow statute enacted for the reasonable goal of combating malicious hackers: people who break into computer systems and steal valuable data (like credit-card numbers) or do real economic damage" (Wu 2013). However, because of the vague wording of the law, it has been increasingly deployed by prosecutors in a much wider range of cases in a manner that makes many legal scholars profoundly uncomfortable (Wu 2013). "Over the years, Congress expanded the statute five times, adding private rights of action and making misdemeanors into felonies. Both private litigants and the Justice Department began to use the law against not only hackers but also otherwise legitimate users who violate the terms-of-service policies that come with nearly every piece of software and service we use on computers today" (Wu 2013). Thus, the original intention and spirit of the law have been violated, and needless amounts of time and energy are being diverted to prosecute relatively minor offenses.
References
Computer Fraud and Abuse Act Reform. (2014). EFF. Retrieved from https://www.eff.org/issues/cfaa
Doyle, C. (2014). Cybercrime: An overview of the Federal Computer Fraud and Abuse Statute and related federal criminal laws. Retrieved from
Wu, T. (2013). Fixing the worst law in technology. The New Yorker. Retrieved from http://www.newyorker.com/news/news-desk/fixing-the-worst-law-in-technology
Create your account
Always verify citation format against your institution’s current style guide requirements.