McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
Business Home → Products & Solutions → Data Protection → US & Global Data Protection Laws → US Federal Laws and Regulations

Computer Fraud and Abuse Act of 1984 (CFAA)

Computer Fraud and Abuse Act
CITATION 18 USC § 1030 et seq.
ENACTED Originally enacted 1984; amended in 1994 and 1996; Amended by USA PATRIOT Act in 2001.
SUMMARY The CFAA outlaws conduct that victimizes computer systems. It protects federal computers, bank computers, and computers connected to the Internet. It shields them from trespassing, threats, damage, espionage, and from being corruptly used as instruments of fraud. The CFAA is not a comprehensive provision but instead it fills cracks and gaps in the protection afforded by other federal criminal laws.
DATA COVERED Seven provisions of the CFAA cover various kinds of criminal activities, which are listed below in “Penalties”. The law protects “national security information,” information that could injure the U.S. or benefit a foreign nation.
INDUSTRY The law protects a “protected computer” which is a computer used by the federal government or financial institution in interstate or foreign commerce. The USA PATRIOT Act amended the definition of “Protected Computer” to include computers outside of the United States as long as those computers affect “interstate or foreign commerce or communications of the United States.”
PENALTIES

Congress did this by making it a felony to access classified information in a computer without authorization, and a misdemeanor to access financial records or credit histories stored in a financial institution or to trespass into a government computer.

The CFAA covers the following criminal activities:

  1. Obtaining National Security Information: Sentence 10 – 20 years;
  2. Compromising the Confidentiality of a Computer: 1 – 5 years;
  3. Trespassing in a Government Computer: 1 – 10 years;
  4. Accessing a Computer to Defraud & Obtain Value: 5 – 10 years;
  5. Knowing Transmission and Intentional Damage: 5 – 20 years or life;
  6. Intentional Access and Damage: 1 – 10 years;
  7. Intentional Access and Reckless Damage: 1 to 10 years;
  8. Trafficking in Passwords: 1 to 10 years; and
  9. Extortion involving threats to Damage Computer – 5 to 10 years.
United States - English