Compliance Management, Government Regulations

30 years later, CFAA still flawed, needs reform, attorney argues

Employees who use corporate- orgovernment-issued digital devices to check sports scores or publish personalsocial media posts are technically in violation of the Computer Fraud and Abuse Act(CFFA) as it is currently written, underscoring the need to reform and clarify the law, according to an article published inrecognition of the act's 30th anniversary.

The CFFA was created in 1986 to defendgovernment assets, financial institutions and interstate commerce againstcomputer-based fraud. But in a Law360article published earlier this month, Peter J. Toren, partner at Washington, D.C., law firm Weisbrod Matteis & Copley PLLC, argued that the law remainsdangerously vague and therefore vulnerable to prosecutorial over-reach.

At the crux of the debate is how tointerpret whether or not an accused party's digital action meets the benchmarkfor “exceeding authorized access,” making it a violation of the CFAA.  Unfortunately, U.S. federal courts are spliton the issue, with some Circuits ruling that a defendant's intent must befactored into the judgment, while others have proclaimed that only the actitself is relevant.

While posting a cat video on Facebookcould theoretically be interpreted as a draconian or pedantic CFAA violation,Toren told in aninterview that a criminal case involving such circumstances are extremelyunlikely. On the other hand, he said, employees who migrate digital assets fromtheir former companies when transitioning from one job to another couldrealistically be the target of CFAA-based civil action, depending on whichfederal circuit court has jurisdiction over that region.

“The problem is: at what point is theline crossed?” said Toren. “Because the whole idea of criminal law is thatpeople have to be put on notice and have an understanding of what is criminaland what isn't criminal.”

Bradley Barth

As director of community content at CyberRisk Alliance, Bradley Barth develops content for SC Media online conferences and events, as well as video/multimedia projects. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Related Events

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.