Cybercrime and hacking are much in the news recently, and the recent wave of ransomware attacks reminds us of how our dependence on heavily networked and interconnected systems can leave even our most critical infrastructure vulnerable to attack. Numerous federal and state statutes seek to provide protection against this kind of activity, but even leaving aside enforcement issues (which can be substantial, particularly for conduct that originates outside the United States) courts have struggled to interpret the precise scope of these laws. While most people have some idea of what "computer hacking" is, defining it with the specificity necessary to impose criminal liability has sometimes turned out to be a challenge.

For example, most federal criminal prosecutions for "hacking" (as that term is generally understood) are brought under the Computer Fraud and Abuse Act (the CFAA), 18 U.S.C. §1030, which covers a broad range of misconduct relating to networked computer systems. Violations of the CFAA can lead to both civil and criminal liability, so the statute attempts to draw bright lines defining its scope. Nonetheless, the courts within the Federal Circuit have disagreed substantially about what conduct the statute actually prohibits—at least at the margins.

Broadly speaking, the CFAA prohibits online misconduct in several categories: obtaining unauthorized access to a system (or exceeding authorized access to a system) and thereby improperly gaining access to protected information, damaging computer systems (either by unauthorized access or by transmitting malicious code), trafficking in passwords and code used for unauthorized access, and extortion or threats related to the prohibited conduct. Although the prohibited conduct is broadly defined, the "access" prohibitions are aimed at a person who "intentionally accesses a computer without authorization or exceeds authorized access." The issue, for many courts, has been the meaning of "exceeding authorized access." If a Netflix subscriber shares their password with a roommate in violation of Netflix's terms of service, is the roommate subject to federal criminal prosecution under the CFAA? The access is "authorized" in the sense that the password is valid and the roommate has the subscriber's permission, but it "exceeds" the authorization set out in the terms of service. Is that contract violation also a federal crime?