Criminalizing Hacking, Not Dating: Reconstructing the CFAA Intent Requirement

Abstract

Cybercrime is a growing problem in the United States and worldwide. Many questions remain unanswered as to the proper role and scope of criminal law in addressing socially-undesirable actions affecting and conducted through the use of computers and modern information technologies. This Article tackles perhaps the most exigent question in U.S. cybercrime law, the scope of activities that should be subject to criminal sanction under the Computer Fraud and Abuse Act (CFAA), the federal "anti-hacking" statute.

At the core of current CFAA debate is the question of whether private contracts, such as website "Terms of Use" or organizational "Acceptable Use Policies" should be able to define the limits of authorization and access for purposes of criminal sanction under the CFAA. Many scholars and activists argue that such contracts should not, because they may result in ridiculous consequences such as the criminalization of misrepresenting one's "desirability" on an online dating website. Critics of such arguments rebut that failing to allow contract-based restrictions opens the door for hackers to engage in many types of activity not otherwise subject to criminal sanction.

This Article examines the tension between these two positions, both from the standpoint of current U.S. jurisprudence and scholarship, and from the standpoint of the respective purposes of criminal and tort law in deterring and punishing socially-undesirable behavior. The Article concludes by proposing a legislative revision to the CFAA that substantially mitigates the risk of overbroad criminalization, while leaving intact the ability of the law to deter and punish the most serious acts affecting and utilizing computers.

Keywords: Cybercrime, Computer Crime, Computer Fraud and Abuse Act, CFAA, Deterrence