Most computer users likely assume that the United States has laws against hacking or otherwise intruding into computers. What those surfing the Internet may not realize, however, is that the language of the U.S. computer intrusion law is so broadly defined and interpreted as to potentially criminalize conduct involving virtually every computer in the world. Moreover, an equally broad definition of what constitutes a “computer,” combined with a vague definition of what constitutes “unauthorized access” to such a computer, means that usage of almost any electronic device worldwide could theoretically form the basis of a crime.

The global reach of U.S. computer intrusion laws is illustrated in a recent opinion from the U.S. District Court for the Eastern District of New York. The opinion, which characterizes the prosecution as “unique” and “cutting-edge,” demonstrates that a computer intrusion violation can be pleaded even when an individual never sets foot in the United States. The opinion also illustrates how, as technological innovation increasingly blurs any remaining lines between a computer and other electronic devices, U.S. computer anti-intrusion laws may eventually come to cover conduct involving virtually every electronic device in the world.

The CFAA

U.S. computer intrusion laws are found in the Computer Fraud and Abuse Act (CFAA), codified at 18 U.S.C. §1030. The CFAA was enacted in 1986 and subsequently amended in a number of significant ways. The CFAA generally prohibits individuals from obtaining information through intrusions into federal government and financial institution computers. Section 1030(a)(2)(C) of the CFAA, however, also makes it a crime for a person to “intentionally accesses a computer without authorization or exceed[] authorized access, and thereby obtain[] … information from any protected computer.” Each of these terms has been broadly defined and interpreted, both factually and geographically.

For example, §1030(e)(1) of the CFAA defines “computer” as “an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device[.]” In 2011, the Supreme Court denied a petition for certiorari from a U.S. Court of Appeals for the Eighth Circuit opinion holding that a cell phone used only to make calls and text constituted a “ computer.”United States v. Kramer, 631 F.3d 900 (8th Cir. 2011), cert. denied, 563 U.S. 1039 (2011). Under this reading, everything from flip phones to smart phones thus qualifies as a “computer.” Moreover, the Eighth Circuit opinion quoted a law review article noting that the term “computer” now means “coffeemakers, microwave ovens, watches, telephones, children's toys, MP3 players, refrigerators, heating and air-conditioning units, radios, alarm clocks, televisions, and DVD players.”