5.1.2.1 Narrow View of “Exceeds Authorized Access” and “Without Authorization”

The more restrictive reading of the CFAA is seen in United States v. Nosal,¹⁷ a 2012 decision of the United States Court of Appeals for the Ninth Circuit, sitting en banc. David Nosal, a former employee of an executive search firm, convinced his ex-coworkers to use their access to the firm's computer systems to provide him with confidential information. The ex-coworkers had access to this data, which Nosal planned to use to start a competing search firm. Nosal was indicted under numerous criminal laws, including section (a)(4) of the CFAA (discussed in depth below). The government charged that Nosal aided and abetted his ex-coworkers in exceeding their authorized access to the network with intent to defraud.¹⁸

Nosal moved to dismiss the CFAA charges, arguing that he did not violate the CFAA because he did not exceed authorized access. According to Nosal, the CFAA only covers hackers, and not those who misuse information to which they had lawful access.¹⁹ The Ninth Circuit agreed with Nosal and adopted his restrictive reading of “exceeds authorized access.” The court concluded that “[i]f Congress meant to expand the scope of criminal liability to everyone who uses a computer in violation of computer use restrictions — which may well include everyone who uses a computer — we would expect it to use language better suited to that purpose.”²⁰ The court reasoned that the government's proposed broad interpretation of “exceeds authorized access” would enable the government to bring federal criminal charges against individuals who innocuously violated workplace computer policies. Such broad governmental discretion, the court reasoned, would lead to truly absurd results:

Employees who call family members from their work phones will become criminals if they send an email instead. Employees can sneak in the sports section of the New York Times to read at work, but they'd better not visit ESPN.com. And sudoku enthusiasts should stick to the printed puzzles, because visiting www.dailysudoku.com from their work computers might give them more than enough time to hone their sudoku skills behind bars.

The effect this broad construction of the CFAA has on workplace conduct pales by comparison with its effect on everyone else who uses a computer, smart-phone, iPad, Kindle, Nook, X-box, Blu-Ray player or any other Internet-enabled device. The Internet is a means for communicating via computers: Whenever we access a web page, commence a download, post a message on somebody's Facebook wall, shop on Amazon, bid on eBay, publish a blog, rate a movie on IMDb, read www.NYT.com, watch YouTube and do the thousands of other things we routinely do online, we are using one computer to send commands to other computers at remote locations. Our access to those remote computers is governed by a series of private agreements and policies that most people are only dimly aware of and virtually no one reads or understands.²¹

The Ninth Circuit's Nosal holding is the most forceful articulation of the narrow approach to interpreting CFAA's “exceeds authorized access” provision. One commentator stated that the opinion “is a huge victory for those of us who have urged the courts to adopt a narrow construction of the CFAA.”²²

In fact, less than a year after the Ninth Circuit issued the Nosal opinion, the U.S. Court of Appeals for the Fourth Circuit adopted the Ninth Circuit's reasoning in a civil CFAA case. In WEC Carolina Energy Solutions LLC v. Miller, WEC,²³ an energy services company, brought a CFAA lawsuit against Mike Miller, a former employee. WEC alleged that before leaving the company, Miller used his access to the company's servers and Intranet to download confidential documents about the company's projects, and later took a job at a WEC competitor and used the confidential information to make a presentation to a potential customer.²⁴

WEC claimed that this violated sections (a)(2), (a)(4), and (a)(5) of the CFAA because Miller used the information without authorization or in excess of authorized access. Although (a)(2) and (a)(4) apply to acts that are either without authorization or exceeding authorized access, (a)(5) only applies to acts that are without authorization. The Fourth Circuit observed that “the distinction between these terms is arguably minute[.]”²⁵ The court concluded that, based on the ordinary meaning of the terms, “authorization” means that “an employee is authorized to access a computer when his employer approves or sanctions his admission to that computer,” and therefore “without authorization” means that the employee “gains admission to a computer without approval.”²⁶ The court concluded that “exceeds authorized access” means that the employee “has approval to access a computer, but uses his access to obtain or alter information that falls outside the bounds of his approved access.”²⁷ Importantly, the court reasoned that neither “without authorization” nor “exceeds authorized access” can be read to include “the improper use of information validly accessed.”²⁸

Imposing liability on individuals based on an individual's use of information – even if they had lawful access – would lead to absurd results, the Fourth Circuit reasoned. For instance, the court stated, this interpretation “would impute liability to an employee who with commendable intentions disregards his employer's policy against downloading information to a personal computer so that he can work at home and make headway in meeting his employer's goals.”²⁹

Most recently, the U.S. Court of Appeals for the Second Circuit adopted the Nosal reasoning in United States v. Valle.³⁰ In that case, Gilberto Valle, a New York City Police Department officer, was charged with crimes arising from online communications in which he discussed committing sexual violence against women he knew. Among the charges was a CFAA violation because he allegedly used his access to law enforcement databases to obtain home addresses, birth dates, and other information about the women who were named in his violent fantasies.³¹ Prosecutors charged that this violated the CFAA because Valle knew of the NYPD's policy that the information was strictly limited to use for official police business.³²

The Second Circuit held that Valle did not violate the CFAA. It relied in part on the legislative history of the 1986 amendments to the CFAA.³³ The Senate Committee Report to these amendments explained that Congress did not intend to impose liability for those “who inadvertently stumble into someone else's computer file or computer data,” and that such a scenario was “particularly true in those cases where an individual is authorized to sign onto and use a particular computer, but subsequently exceeds his authorized access by mistakenly entering another computer or data file that happens to be accessible from the same terminal.”³⁴ The court reasoned that this legislative history “consistently characterizes the evil to be remedied—computer crime—as ‘trespass’ into computer systems or data, and correspondingly describes ‘authorization’ in terms of the portion of the computer's data to which one's access rights extend.”³⁵ The Second Circuit acknowledged that the terms “authorization” and “exceeds authorized access” are ambiguous, but ultimately decided that it is required to adopt the narrower, less punitive version under the “rule of lenity,” a principle of statutory interpretation that requires courts to interpret ambiguous criminal statutes in favor of criminal defendants, based on the principle that it is the duty of Congress, and not the courts, to create laws that punish criminals.³⁶

Under the narrow interpretation of “without authorization” and “exceeds authorized access,” as articulated in Nosal, WEC, and Valle, individuals are only liable for CFAA violations if their initial access to the system or data was not permitted. Therefore, how the individual used the data is irrelevant.

5.1.2.2 Broader View of “Exceeds Authorized Access” and “Without Authorization”

Some other courts have adopted a broader reading of the CFAA, in which individuals may be liable for misusing information to which they initially had lawful access. Typically, courts that adopt the broad approach to the CFAA will hold that violations of contracts, terms of use, and other rules or agreements constitute acting either without authorization or in excess of authorization. In other words, the broader view of the CFAA allows liability not only for code-based violations but also for contract-based violations.³⁷

The first federal appellate court to examine the scope of “exceeds authorized access” and “without authorization” was the U.S. Court of Appeals for the First Circuit, in the 2001 civil CFAA case, EF Cultural Travel BV v. Explorica.³⁸ In that case, a company, EF, brought a CFAA claim against a competitor and the competitors' employees for using an automated software program to scrape pricing information from the company's publicly available website. The employees had previously worked for EF, and had entered into a confidentiality agreement in which they agreed to not disclose or use any confidential information for any third party's benefit or against EF's interests.³⁹ The plaintiffs presented evidence that the former employee used his knowledge of confidential EF information to develop the scraping tool. The defendants requested that the court dismiss the lawsuit, contending that they did not “exceed” authorized access. The First Circuit rejected this argument, concluding that the defendants “would face an uphill battle trying to argue that it was not against EF's interests for appellants to use the tour codes to mine EF's pricing data.”⁴⁰ This is a particularly broad interpretation of the term “exceeds authorized access” because there was not even an allegation that the scraping program violated an explicit terms of use or other policy on a user agreement.

Violations of terms of use and workplace policies are more common for charges of exceeding authorized access under the CFAA. For instance, in United States v. Rodriguez,⁴¹ the government brought CFAA charges against Roberto Rodriguez, a former Social Security Administration customer service representative. SSA's policies prohibited its employees from obtaining information “without a business reason.” Rodriguez refused to sign forms acknowledging the policy, and accessed the Social Security records of seventeen individuals without a business reason, and without the individuals' knowledge. Among the individuals whose records were accessed was Rodriguez's ex-wife.⁴² Rodriguez was convicted of violating the CFAA, and on appeal to the U.S. Court of Appeals for the Eleventh Circuit, he argued that he did not “exceed authorized access” because his access was limited to the databases that he was permitted to access due to his job requirements.⁴³

The court rejected Rodriguez's argument and held that he exceeded his authorized access by accessing the information for reasons unrelated to his job.⁴⁴ The court reasoned that this constituted a CFAA violation because the Social Security Administration had explicitly told him that he was not permitted to obtain the information for reasons that were unrelated to business purposes. In other words, the court concluded, the violation occurred not because Rodriguez misused the information, but because he obtained the information in violation of the Social Security Administration's policy.

Rodriguez also argued that he did not exceed authorized access because he did not use the information in a criminal manner (e.g., for identity theft). The court quickly disregarded this argument, concluding that the manner in which he used the information is not relevant to deciding whether he violated the CFAA; the inquiry for the court was whether he obtained the information in violation of the statute.⁴⁵ The Rodriguez case is an example of a broad reading of the CFAA, in which the focus of the court's inquiry is not merely whether the initial access was authorized, but whether the access was used to further unauthorized activities.

Similarly, in United States v. John,⁴⁶ Dimetriace Eva-Lavon John, a Citigroup employee, used her credentials to provide information about corporate customers' financial accounts to her half-brother, who used the information to commit fraud.⁴⁷ John was charged and convicted on a number of counts, including the CFAA. On appeal, she argued that she did not exceed authorized access because she was authorized to access and view the corporate customer account information. The U.S. Court of Appeals for the Fifth Circuit rejected this argument, concluding that “authorized access” may include use limitations that are placed on the information, “at least when the user knows or reasonably should know that he or she is not authorized to access a computer and information obtainable from that access in furtherance of or to perpetrate a crime.”⁴⁸ For instance, the court wrote, if an employer authorizes employees “to utilize computers for any lawful purpose but not for unlawful purposes and only in furtherance of the employer's business,” the company's employees would exceed authorized access if they “used that access to obtain or steal information as part of a criminal scheme.”⁴⁹

Applying this definition of authorized access to the charges against John, the Fifth Circuit concluded that she clearly violated the CFAA. The court noted that Citigroup's internal policy, which was presented to John at employee training sessions, explicitly barred employees from misusing confidential information. “Despite being aware of these policies,” the court concluded, “John accessed account information for individuals whose accounts she did not manage, removed this highly sensitive and confidential information from Citigroup premises, and ultimately used this information to perpetrate fraud on Citigroup and its customers.”⁵⁰ Key to the court's decision was evidence that John had actually been trained on the policies that prohibited such access.

In short, the broad interpretation of CFAA includes not only code-based violations, but also violations based on contract and norms.

5.1.2.3 Attempts to Find a Middle Ground

Courts nationwide have recognized the clear split between the Nosal/WEC/Valle narrow reading of the CFAA and the John/Rodriguez broad reading. Some courts, rather than selecting one definition, have attempted to distinguish the two lines of thinking and find a middle ground in which the facts of each case determine which reading of the CFAA to apply.

For instance, in 2015, the U.S. District Court for the District of Columbia reasoned that the reading of the CFAA depends in part on whether the defendant knowingly violated the law or an agreement. In Roe v. Bernabei & Wachtel PLLC,⁵¹ the plaintiff had secretly recorded her employer allegedly sexually harassing her. She allowed a coworker to copy the video. The coworker, along with other colleagues, later sued the employer. They also allegedly provided the media with copies of the video.⁵² The plaintiff sued the former coworkers and their law firm for, among other things, violating various provisions of the CFAA by intentionally accessing a protected computer while exceeding authorization, and obtaining information from that computer and furthering intended fraud.⁵³

The defendants moved to dismiss this claim, arguing that a CFAA violation did not exist because the plaintiff had voluntarily allowed her coworker to copy the video. The judge recognized that courts have different interpretations of the term “exceeds authorized access.” The judge ultimately concluded that the narrower version, as articulated in Nosal, applied to this case, and dismissed the CFAA claims. The judge reasoned that the more expansive view, as stated in cases such as Rodriguez, involves “circumstances in which employees knowingly violated internal employer policies related to the use of data, either unlawfully, or in violation of their employment agreement.”⁵⁴ In this case, there was no allegation of an explicit agreement or law that prohibited the defendants from sharing this information. Although the court adopted the Nosal line of reasoning for this case, it is possible that, had the coworkers violated an explicit agreement, the court would have sustained the CFAA claims.

As courts continue to apply both interpretations of the CFAA to a wide set of fact patterns, it will be increasingly difficult for courts to find such a middle ground; the interpretations clearly conflict with each other. Quite simply, the federal courts are split as to whether an individual can be found guilty of violating the CFAA merely by misusing information to which the individual had proper access. Unless the United States Supreme Court eventually resolves the issue, federal courts will continue to apply different definitions of “without authorization” and “exceeds authorized access.” A court's decision about which interpretation to use will inevitably affect the fate of any CFAA criminal prosecution or civil lawsuit.

5.1.3.1 CFAA Section (a)(1): Hacking to Commit Espionage

Section (a)(1) prohibits individuals from knowingly accessing a computer without authorization or exceeding authorized access, and obtaining classified information, and willfully communicating, delivering, transmitting, or causing the communication, delivery, or transmission to any person who is not authorized to receive the information.⁵⁶ The statute also prohibits the willful retention of the data, and failure to deliver it to the U.S. employee who is entitled to receive it. Section (a)(1) only applies if the individual had reason to believe that the information could be used to injure the United States or to the advantage of a foreign nation.

No published court opinion interprets this subsection, largely because it is rare for prosecutions to be brought under this subsection. That likely is because the federal government typically brings espionage-related hacking prosecutions under the Espionage Act,⁵⁷ which criminalizes many forms of unauthorized access, use, and disclosure of classified information.

Violations of Section (a)(1) are felonies, and violations carry prison terms of up to ten years and fines. If an individual violates Section (a)(1) after having been convicted of another CFAA violation, the prison term can be up to twenty years.

5.1.3.2 CFAA Section (a)(2): Hacking to Obtain Information

Section (a)(2) of the CFAA prohibits individuals from intentionally accessing computers without authorization or in excess of authorized access, and obtaining (1) information contained in a financial record of a financial institution, card issuer, or consumer reporting agency; (2) information from any federal government department or agency; or (3) information from any “protected computer,” which the CFAA defines as a computer that is either used by a financial institution or the federal government, or is used in or affecting interstate or foreign commerce.⁵⁸

Because it is relatively easy to demonstrate that companies' computers affect interstate or foreign commerce, Section (a)(2) is a frequent basis for CFAA criminal prosecutions and civil litigation. Indeed, the CFAA had initially only applied to computers that are used in interstate commerce, but in 2008, Congress amended the statute to include computers that affect interstate commerce because it recognized the need to “address the increasing number of computer hacking crimes that involve computers located within the same state[.]”⁵⁹ Under this incredibly broad definition of “protected computer,” it is difficult to imagine any U.S. companies whose computers do not qualify as “protected computers” that are covered by the CFAA. Indeed, one federal court in California stated that the requirement for a “protected computer” will “always be met when an individual using a computer contacts or communicates with an Internet website.”⁶⁰ Moreover, in 2001, Congress amended the CFAA to clarify that it applies not only to actions that affect interstate commerce but also foreign commerce. As the U.S. Justice Department observed, this amendment “addresses situations where an attacker within the United States attacks a computer system located abroad and situations in which individuals in foreign countries route communications through the United States as they hack from one foreign country to another.”⁶¹

The act covered by Section (a)(2) – obtaining information – is quite broad. In the Senate report accompanying the 1986 amendments to CFAA that established Section (a)(2), the legislators wrote that “obtaining information” includes “mere observation of the data.”⁶² The legislators clarified that, for the government or a litigant to demonstrate that an individual obtained information under Section (a)(2), they need not prove that the defendant had been “physically removing the data from its original location or transcribing the data[.]”⁶³ In the three decades since this report, there has been little dispute that “obtaining information” under Section (a)(2) does not necessarily include the actual removal of the data. Observation of data – such as by hacking into a company's website – is sufficient to establish that the individual “obtained” the information. However, there are some limits to the breadth of this definition. Merely accessing a computer without authorization or in excess of authorization – and not actually viewing or otherwise obtaining any information – will not constitute a Section (a)(2) violation.

Perhaps the most significant barrier to charges or claims under Section (a)(2) is the requirement that the act of obtaining information be intentional. Congress intentionally set this higher standard in its 1986 amendments to the CFAA. The initial 1984 version of the CFAA applied to acts that were committed “knowingly.” In 1986, Congress replaced “knowingly” with “intentionally.” In the report accompanying the 1986 amendments, the Senate committee members wrote that “intentional acts of unauthorized access – rather than mistaken, inadvertent, or careless ones – are precisely what the Committee intends to proscribe.”⁶⁴ The Committee analyzed Supreme Court precedent that interpreted the term “knowingly,” and reasoned that the “knowingly” standard could apply to acts that apply whenever the individual is “aware that the result is practically certain to follow from his conduct, whatever his desire may be as to that result.”⁶⁵ Although this broad definition of “knowingly” might be appropriate for other crimes, the Committee reasoned that it is not appropriate for computer hacking because it “might not be sufficient to preclude liability on the part of those who inadvertently ‘stumble into’ someone else's computer file or computer data.”⁶⁶

Replacing “knowingly” with “intentionally,” the Committee concluded, “is designed to focus Federal criminal prosecutions on those whose conduct evinces a clear intent to enter, without proper authorization, computer files or data belonging to another.”⁶⁷ The Committee, relying on earlier interpretations of the term “intentional,” stated that it “means more than one voluntarily engaged in conduct or caused a result. Such conduct or the causing of the result must have been the person's conscious objective.”⁶⁸

The limits imposed by the word “intentionally” were evident in a 2006 federal court opinion in the District of Columbia, arising from a civil action against IBM.⁶⁹ Butera & Andres, a DC law firm, alleged that its servers were hacked, and the attacker's IP addresses were located at an IBM facility in North Carolina. The law firm sued IBM and the anonymous individual – whom the firm alleged to be an employee of IBM – under a variety of causes of action, including a violation of Section (a)(2) of the CFAA. IBM moved to dismiss the claims, arguing that the plaintiff's complaint failed to allege that IBM acted intentionally.⁷⁰ The district court granted IBM's motion to dismiss, agreeing that the complaint failed to allege that IBM acted with any intent. The court reasoned that the mere allegation that the hacker's IP addresses were located in IBM's facilities did not permit an inference that IBM participated in the alleged hacking.⁷¹ “Far from pleading any intentional conduct on the part of IBM,” the court observed, “the plaintiffs' position appears directed, at most, at establishing the likelihood that an individual employed at the IBM facility in Durham is responsible for the alleged attacks.”⁷² Such an allegation does not rise to the level of “intentional” hacking, the court concluded.⁷³

Demonstrating intent under Section (a)(2), however, is not an insurmountable task. Indeed, courts generally have held that for the government or a civil plaintiff to establish a Section (a)(2) violation, they only need to prove that the defendant intended to obtain information by accessing a computer without authorization or exceeding authorized access. It is unnecessary to demonstrate that the defendant intended for the information to be used in any particular way.

For example, in a 2007 case, United States v. Willis,⁷⁴ defendant Todd A. Willis, an employee of an Oklahoma City debt collection business, had access to a proprietary database of individuals' personal information, and was explicitly prohibited from obtaining the information for personal reasons.⁷⁵ A law enforcement investigation revealed that Willis provided his drug dealer with a coworker's credentials, and the credentials were later used to commit identity theft.⁷⁶ Willis was charged with aiding and abetting a violation of Section (a)(2), convicted by jury, and sentenced to forty-one months in prison.⁷⁷ On appeal to the U.S. Court of Appeals for the Tenth Circuit, Willis argued that his conviction was invalid because he did not have the intent to defraud when he provided the credentials. The Tenth Circuit rejected this argument after reviewing the legislative history of the 1986 amendments to CFAA, and concluded that the government did not have an obligation to demonstrate that Willis intended to use the information in any particular way; the inquiry for the court was whether his intentional access and obtaining of the information violated the CFAA.⁷⁸

Similarly, in Thayer Corporation v. Reed,⁷⁹ Thayer Corporation filed a civil lawsuit against its former Chief Financial Officer, David Reed. Among the many counts in the complaint was a CFAA claim under Section (a)(2). Thayer alleged that for approximately a week after Reed's employment ceased, he forwarded Thayer human resources emails to his personal email account. Reed asserted that the email transfers were the result of a mistake by his phone provider, and that as soon as he saw that he was receiving the Thayer emails, he directed the phone company to fix the issue. The court rejected this argument, reasoning that the complaint alleged that Reed “intercepted, read, deleted and forwarded emails from Thayer's human resources director,” explained that Reed created Thayer's password system, and alleged that Reed “knew of discussions regarding his severance package, information that only could have been obtained from the human resources manager's emails.” Assuming that the allegations in the complaint were true, the court concluded, “Mr. Reed could not have unintentionally done any of these things; each requires the intent to access, intercept, and use Thayer's email system without authorization, causing harm.”⁸⁰

These cases have a consistent theme: to satisfy the “intentional” requirement of Section (a)(2), the government or civil plaintiff must establish that the defendant knew that they were obtaining the information through unauthorized hacking. However, they need not establish that the defendant intended to cause harm, defraud, or support the commission of another crime.

Section (a)(2) violations may be charged as felonies or misdemeanors. If a violation is charged as a misdemeanor, the defendant could be punished by a fine and up to one year in prison. A violation of Section (a)(2) may be charged as a felony, punishable by a fine and up to five years in prison, if one of the following is true: (1) the offense was committed for commercial advantage or private financial gain; (2) the office was committed in furtherance of any criminal or tortious act that violates the U.S. Constitution or any federal or state laws; or (3) the information obtained is valued at more than $5000. Additionally, if an individual violates Section (a)(2) after having previously been convicted of a CFAA violation, that individual can be charged with a felony punishable by a fine and up to ten years in prison.

5.1.3.3 CFAA Section (a)(3): Hacking a Federal Government Computer

Section (a)(3) prohibits individuals from intentionally accessing nonpublic federal government computers without authorization. This prohibition applies to both computers that are “exclusively for the use of the Government of the United States,” and computers that are “used by or for the Government of the United States and such conduct affects that use by or for the Government of the United States.”⁸¹

At first glance, one might wonder why Section (a)(3) is necessary, since Section (a)(2) also explicitly prohibits certain hacks of federal government computers. Section (a)(3) differs because it prohibits the mere act of intentionally accessing a federal government computer without authorization, regardless of whether the defendant actually obtained any information. This provision was conceived two years after the initial CFAA was enacted, members of Congress indicated a desire to “balance its concern for Federal employees and other authorized users against the legitimate need to protect Government computers against abuse by ‘outsiders.’”⁸² Congress addressed this balance by amending the CFAA to create this separate prohibition on unauthorized access to federal computers. According to the Senate report accompanying the amendments, this section was drafted in response to the U.S. Justice Department's concerns about whether Section (a)(2) “covers acts of mere trespass,” that is, unauthorized access, or whether it requires a further showing that the information perused was “used, modified, destroyed, or disclosed.”⁸³ Congress stated that it intended for Section (a)(3) to create “a simple trespass offense” that applies “to persons without authorized access to Federal computers.”⁸⁴ In this respect, Section (a)(3) is significantly broader than Section (a)(2).

However, Section (a)(3) also is narrower than Section (a)(2) in one important area: while Section (a)(2) applies to both access without authorization and exceeding authorized access, Section (a)(3) only applies to access without authorization. Congress intentionally excluded “exceeding authorized access” from Section (a)(3) due to its belief that “government employees and others who are authorized to use a Federal Government computer would face prosecution for acts of computer access and use that, while technically wrong, should not rise to the level of criminal conduct,” according to the 1986 Senate report.⁸⁵ The legislators concluded that if an employee “briefly exceeds his authorized access and peruses data belonging to the department that he is not supposed to look at,” the employee should be subject to administrative sanctions, but not criminal penalties.⁸⁶

Section (a)(3) does not apply to unauthorized access of any federal government computer. In 1996, Congress amended Section (a)(3) to clarify that it only applies to unauthorized access of nonpublic federal government computers. In the Senate report accompanying the 1996 amendment, Congress warned that despite the new restriction of Section (a)(3) to nonpublic federal government computers, “a person who is permitted to access publicly available Government computers, for example, via an agency's World Wide Web site, may still be convicted under (a)(3) for accessing without authority any nonpublic Federal Government computer.”⁸⁷

There have been few prosecutions under Section (a)(3). Among the few was a recent criminal case against Jerry Wang, the chief executive officer of two universities in California. The government alleged that Wang provided one of his employees with Wang's access to the Department of Homeland Security's Student and Exchange Visitor Information System, which processes the information that DHS uses to determine whether universities are complying with student immigration laws. The government alleges that this unauthorized employee filed forged documents. Among the fifteen counts was a charge that Wang violated Section(a)(3). Wang moved to dismiss this count, arguing that providing log-in credentials to an employee to input data does not violate Section (a)(3). The court denied this motion, concluding that the indictment sufficiently alleged a violation of the statute.⁸⁸

The U.S. Department of Justice's manual on computer crimes attributes the lack of prosecutions under Section (a)(3) to the fact that a first-time violation of Section (a)(3) is a misdemeanor, while a first-time violation of Section (a)(2) may be charged as a felony, with greater penalties.⁸⁹ Accordingly, if an act falls under both Section(a)(2) and Section (a)(3), prosecutors may have greater incentive to bring the charges under Section (a)(2).

If, however, an individual is charged under Section (a)(3) after having previously been convicted of a CFAA violation, the crime can be charged as a felony with a fine and up to ten years in prison.

5.1.3.4 CFAA Section (a)(4): Hacking to Commit Fraud

Section (a)(4) prohibits individuals from knowingly and with intent to defraud accessing a protected computer without authorization, or exceeding authorization, and furthering the intended fraud and obtaining anything of value. This provision does not apply if the object of the fraud and the thing obtained consists only of the use of the computer, and the value of that use is not more than $5000 during any one-year period.⁹⁰

Section (a)(4) is similar to the federal mail fraud and wire fraud statutes. But when Congress enacted this provision in the 1986 amendments to CFAA, it expressed a desire to ensure that fraud conducted over a computer – rather than the mails or wires – be covered explicitly under a criminal law. According to the Senate report accompanying the amendments, for a prosecution under Section (a)(4), “the use of the computer must be more directly linked to the intended fraud,” meaning that it “must be used by an offender without authorization or in excess of his authorization to obtain property of another, which property furthers the intended fraud.”⁹¹

Courts generally have been willing to conclude that a wide range of types of improper access “further” the intended fraud, as required by Section (a)(4). For instance, in United States v. Lindsley,⁹² the defendant was charged with violations of Section (a)(4) and other statutes for using his personal computer to illegally access Sprint's internal computer system and steal customers' calling card numbers. His co-defendants allegedly sold the calling card numbers, and the government alleged that the total losses that Lindsley caused exceeded $1.8 million. Lindsley pleaded guilty and was sentenced to forty-one months in prison. The large prison sentence was primarily due to a sentencing enhancement that was triggered by the large losses. Lindsley appealed the sentence and argued that it was not reasonably foreseeable that his co-defendants would resell the card numbers. The U.S. Court of Appeals for the Fifth Circuit, in an unpublished opinion, affirmed the sentence, concluding that the loss was foreseeable and therefore was properly foreseeable to Lindsley.⁹³

Similarly, in United States v. Bae,⁹⁴ the defendant, a retailer whose store sold lottery tickets, pleaded guilty to a Section (a)(4) violation. He was charged with using his lottery terminal to generate more than $500,000 in tickets for himself. The tickets were redeemable for more than $296,000 and the defendant redeemed them for approximately $224,000. When calculating his sentence, the district court attributed $503,650 in losses, equal to the total value of the tickets after subtracting the commission that the defendant would have received as a retailer. The defendant appealed the sentence, arguing that the market price does not reflect the actual cost to the lottery system, and that therefore the district court should have calculated his sentence based on the redemption value of the tickets. The U.S. Court of Appeals for the D.C. Circuit rejected this argument and affirmed his sentence, concluding that the proper measure of damage under Section (a)(4) is the fair market value of the property at the time that it was illegally acquired.⁹⁵

Although both the Lindsley and Bae opinions dealt with the narrow issue of criminal sentencing, the courts' reasoning indicates a willingness to broadly attribute subsequent fraud to an initial illegal access. In other words, even if the eventual fraud is attenuated from the initial access, the defendant still may be liable under Section (a)(4).

Perhaps the largest barrier to Section(a)(4) cases is the requirement to demonstrate that the defendant obtained something “of value” that is worth more than $5000. Consider the prosecution of Richard Czubinski, a customer service employee at the Internal Revenue Service. The federal government brought charges against Czubinski under numerous statutes, including Section (a)(4), alleging that he used his credentials to search the tax records of a number of people for whom he had no legitimate business reason to be querying, including political staffers, a state prosecutor who handled a case against his father, his brother's instructor, and a woman whom Czubinski had dated.⁹⁶ At trial, there was evidence that he only mentioned his access to the data to one acquaintance, and there was no further evidence that he had shared or otherwise used any of the information that he viewed.⁹⁷ He was convicted by a jury on thirteen counts, and appealed.

In 1997, the U.S. Court of Appeals for the First Circuit reversed his Section (a)(4) conviction. (At the time, Section (a)(4) required proof that the hacker obtained something of value, but did not have a $5000 minimum value.) At issue in the appeal was whether the taxpayer IRS information qualifies as something of “value,” even though there was no evidence that Czubinski used it in any way. The court concluded that in this case, the government failed to demonstrate that the information had any value to Czubinski. Instead, the court reasoned, he accessed the data merely to satisfy his “idle curiosity.”⁹⁸ In other words, viewing confidential information – and not doing anything with that knowledge – does not constitute obtaining a thing “of value” in violation of Section (a)(4). The mere act of accessing information on a computer without authorization or in excess of authorization more easily fits under Section (a)(2).

Section (a)(4)'s intent requirement is more specific than other sections of the CFAA: the violation must not only be done knowingly, but it must be done with intent to defraud. One of the few courts that has interpreted this phrase in the context of the CFAA took a fairly broad approach. In Shurgard Storage Centers v. Safeguard Self Storage,⁹⁹ the plaintiff, a self-storage company, alleged that one of its managers emailed confidential business information to its competitor, and was later hired by the competitor. The plaintiff sued the competitor alleging a number of claims, including violation of Section (a)(4). The competitor moved to dismiss the complaint, arguing that the complaint did not adequately allege that the competitor intended to defraud the plaintiff.¹⁰⁰ At common law, to demonstrate that fraud occurred, a plaintiff must demonstrate nine elements, including a representation of fact that was false, and the plaintiff's reliance on this false statement. Requiring a Section (a)(4) plaintiff (or a government prosecutor) to demonstrate common-law fraud would make it exceptionally difficult to bring a case under this provision. The court rejected this reading of Section (a)(4), agreeing with the plaintiff that, in the context of Section (a)(4), “defraud” means “wronging one in his property rights by dishonest methods and schemes.”¹⁰¹ The court reasoned that Section (a)(4) does not require proof of common-law fraud, and only requires demonstration of a “wrongdoing.”¹⁰²

A federal judge in Iowa later adopted the broad definition of “defraud” as articulated in Shurgard Storage Centers. In NCMIC Finance Corporation v. Artino,¹⁰³ a company alleged that a former executive violated Section (a)(4) when he used his access to the company's computer systems to obtain confidential customer information. The judge concluded that these actions constituted an intent to defraud for the purposes of Section (a)(4) because they harmed the plaintiff's property rights.¹⁰⁴

Violations of Section (a)(4) are charged as felonies punishable by a fine or imprisonment of up to five years. If the defendant had previously been convicted of violating the CFAA, the prison term can be up to ten years.

5.1.3.5 CFAA Section (a)(5): Hacking to Damage a Computer

Section (a)(5) of the CFAA prohibits three types of behavior, all related to damaging computers through hacking: (1) knowingly causing the transmission of a program, information, code, or command, and, as a result of such conduct, intentionally causing damage without authorization, to a protected computer; (2) intentionally accessing a protected computer without authorization, and as a result of such conduct, recklessly causing damage; or (3) intentionally accessing a protected computer without authorization, and as a result of such conduct, causes damage and loss.¹⁰⁵

Section (a)(5) is among the more commonly prosecuted and litigated provisions of the CFAA, as it covers a wide range of actions, including the deployment of viruses and malware, denial-of-service attacks, and deletion of data. The three subsections of (a)(5) are quite different, and therefore we will examine each separately.

5.1.3.6 CFAA Section (a)(6): Trafficking in Passwords

Section (a)(6) of the CFAA prohibits individuals from knowingly, and with the intent to defraud, trafficking in passwords or similar information through which a computer can be accessed without authorization, provided that the trafficking either affects interstate or foreign commerce, or the computer is used by or for the federal government. Because of the relatively small penalties attached to Section (a)(6), it is among the less commonly prosecuted and litigated sections of the CFAA.

Congress added Section (a)(6) to the CFAA in 1986, out of concern that hackers were using “pirate bulletin boards” to share victims' passwords.¹³⁴

Section (a)(6) is intended to broadly define the term “password,” and cover a wide range of information that can be used to access a computer. The Senate Judiciary Committee's report accompanying the 1986 bill clarified that the legislators intended to not only protect the single string of characters commonly thought of as a “password” but also intended to cover “longer more detailed explanations on how to access others' computers.”

In the rare instances in which courts have written opinions interpreting Section (a)(6), there occasionally has been a dispute about the meaning of “trafficking.” Section (a)(6) defines “traffic” as “transfer, or otherwise to dispose of, to another, or obtain control of with intent to transfer or dispose of.” This is a fairly broad definition of “traffic,” and it does not require evidence that the defendant sold the password or information for money. However, the defendant will not be liable for receiving passwords. For instance, in State Analysis v. American Financial Services,¹³⁵ a federal judge dismissed a Section (a)(6) civil lawsuit filed by a database provider against a company that allegedly received a password for the database from another source. The court reasoned that such behavior does not qualify as “trafficking” for the purposes of the CFAA.¹³⁶

Even if the defendant trafficked in passwords, Section (a)(6) only applies if the prosecutor or plaintiff can demonstrate that the defendant did so with an intent to defraud. In AtPac, Inc. v. Aptitude Solutions,¹³⁷ Inc., Nevada County, California was transitioning software service providers, from AtPac to Aptitude Solutions. To make the transition easier, Nevada County requested that AtPac provide Aptitude with a user account, allowing Aptitude to access the county's data. Nevertheless, a county employee created a log-in account on AtPac's system and provided it to Aptitude. AtPac sued the county and Aptitude for violating Section (a)(6). The district court swiftly dismissed this claim. The court noted that merely providing another person with a password is not prohibited by Section (a)(6). That provision only applies, the court noted, if the defendant intended to defraud. Although the County employee's actions might have violated AtPac's license agreement, the court reasoned, there was no evidence that the County intended to defraud AtPac. The County's actions were “not the sort of fraud Congress envisioned when it made password trafficking subject to criminal penalties,” the court wrote.¹³⁸

Moreover, Section (a)(6) only applies if the traffic password allows a computer to be accessed without authorization. The AtPac court concluded that this also provided it with a reason to dismiss the lawsuit. The court determined that under the CFAA, “a person cannot access a computer ‘without authorization’ if the gatekeeper has given them permission to use it.”¹³⁹ AtPac had already given the County permission to log in to the server. The court wrote that it “cannot conclude that Congress intended to impose criminal liability on third parties just because a computer licensee violates a license agreement.”¹⁴⁰

If the defendant has not been convicted of a CFAA violation before violating Section (a)(6), the defendant can be sentenced to a fine and no more than a year in prison. If the defendant had been convicted of a CFAA violation before violating Section (a)(6), the defendant can be sentenced to a fine and up to ten years in prison.

5.1.3.7 CFAA Section (a)(7): Threatening to Damage or Obtain Information from a Computer

Section (a)(7) prohibits individuals from transmitting in interstate or foreign commerce any communication containing three types of threats or demands: (1) a threat to damage a protected computer; (2) a threat to obtain information from a protected computer without authorization or in excess of authorization or to “impair the confidentiality of information obtained from a protected computer without authorization or by exceeding authorized access”; or (3) a demand or request for “money or other thing of value in relation to damage to a protected computer, where such damage was caused to facilitate the extortion.”¹⁴¹ Section (a)(7) only applies if the defendant was acting with intent to extort from any person any money or other thing of value.

Unlike Sections (a)(1)–(a)(5), Section (a)(7)'s applicability does not depend on whether the defendant actually accessed, damaged, or obtained information from a computer. Instead, Section (a)(7) applies to the defendant's attempt to extort money from a victim by threatening a computer crime.

Section (a)(7) addresses a similar crime that is prohibited by the Hobbs Act, a 1948 federal extortion law. That statute imposes a sentence of a fine and up to twenty years in prison on any individual who “threatens physical violence to any person or property.”¹⁴² In the 1996 Senate Report accompanying the CFAA amendments, Section (a)(7)'s authors wrote that Section (a)(7) was necessary because the term “property” in the Hobbs Act “does not clearly include the operation of a computer, the data or programs stored in a computer or its peripheral equipment, or the decoding keys to encrypted data.”¹⁴³ The government likely could attempt that computers, networks, and data are property under the Hobbs Act, but it wanted a more direct route to prosecute online extortionists that would present less legal uncertainty. In fact, defendants who are charged with violating Section (a)(7) often also are charged with violating the Hobbs Act.

Section (a)(7) is relatively new to the CFAA. Congress added the provision in 1996, after the U.S. Justice Department reported that hackers had increasingly made threats to penetrate computer systems. In the Senate report accompanying the 1996 amendments to the CFAA, the legislators expressed a desire to “address a new and emerging problem of computer-age blackmail.”¹⁴⁴

In fact, Congress's motivations for amending the CFAA appear to be quite prescient more than two decades later. As Congress explained:

One can imagine situations in which hackers penetrate a system, encrypt a database and then demand money for the decoding key. This new provision would ensure law enforcement's ability to prosecute modern-day blackmailers, who threaten to harm or shut down computer networks unless their extortion demands are met.¹⁴⁵

Sound familiar? Twenty years after Congress enacted Section (a)(7), ransomware became among the most concerning trends in cybersecurity. Theoretically, Section (a)(7) provides a very direct mechanism to bring criminal and civil actions against hackers that have used ransomware to attempt to extort money from companies and individuals. However, many of the most egregious ransomware distributors hide behind well-masked anonymity, making prosecutions and civil lawsuits quite difficult. They use Bitcoin as the payment currency, further cloaking their identity and the ability to be tracked by law enforcement.

Ransomware – and other extortion attempts – often originate from other countries. Congress contemplated this problem in 1996 when it drafted Section (a)(7), and explicitly stated that it covers threats used in both interstate and foreign commerce. The government used this ability to prosecute foreign extortionists in United States v. Ivanov.¹⁴⁶ Aleksey Ivanov allegedly hacked into the computer system of a Connecticut company that processes online retailers' credit card transactions. While he was located in Russia or another former Soviet bloc country, Ivanov emailed the company to inform them that he obtained its system administrator root passwords, threatened to destroy its database, and demanded $10,000.¹⁴⁷ Among the email messages that he sent was the following:

[name redacted], now imagine please Somebody hack you network (and not notify you about this), he download Atomic software with more than 300 merchants, transfer money, and after this did ‘rm-rf/’ and after this you company be ruined. I don't want this, and because this i notify you about possible hack in you network, if you want you can hire me and im allways be check security in you network. What you think about this?¹⁴⁸

Ivanov was indicted in federal court in Connecticut on eight counts, including a violation of Section (a)(7). Ivanov filed a motion to dismiss the indictment, arguing that because he was in Russia or another Soviet bloc country at the time of the alleged email threats, the CFAA and other statutes could not apply to him. The district court denied this motion for two reasons. First, it reasoned that if an individual violates a law with the intent to cause effects within the United States, then U.S. courts have jurisdiction to hear criminal cases involving that action.¹⁴⁹ Ivanov allegedly transmitted a threat to a company located in Connecticut, and threatened to further damage its computers, also located in Connecticut.¹⁵⁰ Second, the court concluded that Section (a)(7)'s explicit reference to computers used in “foreign” commerce demonstrated an intent of Congress to apply the statute extraterritorially.¹⁵¹

Courts have generally required a Section (a)(7) indictment or civil claim to provide proof of an explicit threat. Merely hacking to cause damage or obtain information will not sustain a Section (a)7) claim, even if that action violates other parts of the CFAA. In Ivanov's case, the email was clear proof of an explicit threat that violates Section (a)(7).

In other cases, however, the evidence of a threat is not as compelling. In Vaquero Energy v. Herda,¹⁵² Vaquero Energy, an oil and gas collection and installations company, hired Jeff Herda to provide information technology support. Vaquero Energy alleges that Herda and his company changed the passwords to critical SCADA systems and devices without Vaquero Energy's permission.¹⁵³ Vaquero Energy claimed that it asked Herda to provide all of its log-ins and passwords, but Herda provided incomplete information, and that he later stopped providing services to the company. Vaquero Energy claimed that its lack of password information left its systems vulnerable and insecure, and sued Herda under a number of statutes, including Section (a)(7) of the CFAA. In a preliminary injunction order, the court concluded that the Section (a)(7) claim was unlikely to succeed on the merits because Vaquero Energy did not allege that Herda made a threat or demand. Although Vaquero Energy's lawyer demanded that Herda provide the passwords, and Herda responded, the court concluded that this exchange did not constitute a demand or threat made by Herda.¹⁵⁴ Moreover, the court found that the claim also failed because there was no allegation that Herda changed the password in order to extort money. The Vaquero Energy case demonstrates the need for prosecutors and civil litigants to allege a specific threat and intent to extort money.

A defendant is convicted of a violation of Section (a)(7) faces a fine and up to five years in prison. If the defendant had been convicted of a CFAA offense before violating Section (a)(7), the defendant faces a fine and up to ten years in prison.

5.3.2.1 DMCA Section 1201(a)(1)

Section (a)(1) of the DMCA is perhaps the most direct and least controversial of the three sections. It prohibits individuals from circumventing “a technological measure that effectively controls access to a work” that is protected by copyright law.¹⁸⁵

Congress included Section (a)(1) because, at the time the DMCA was passed, “the conduct of circumvention was never before made unlawful,” according to the Senate report accompanying the DMCA.¹⁸⁶

At the outset, it is important to note that Section (a)(1) focuses solely on whether the defendant circumvented technology that protects a copyrighted work. As legislators stated when they drafted the DMCA, the types of actions prohibited by Section (a)(1) are analogous to “breaking into a locked room in order to obtain a copy of a book.”¹⁸⁷ Section (a)(1) does not restrict subsequent use, performance, or distribution of the copyrighted materials that are obtained via this circumvention; those activities are protected in other provisions in U.S. copyright law.¹⁸⁸

The statute explicitly states that a technological measure “effectively controls access to a work” if the measure, “in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright towner, to gain access to the work.”¹⁸⁹ Courts generally have broadly included many types of controls under this definition, and they typically do not require a high degree of technological sophistication for a control to qualify as a technological measure. For instance, in IMS Inquiry Management Systems, LTD v. Berkshire Information Systems, Inc.,¹⁹⁰ the plaintiff, which offered a web-based system that companies use to track magazine advertising, alleged that its competitor accessed its service without authorization and copied content for use on its competing service. The plaintiff alleged that the competitor obtained the log-in credentials from a third party, in violation of the user agreement.¹⁹¹ The court concluded that the plaintiff's password protection constitutes an effective technological measure under Section (a)(1) because to access the plaintiff's service, “a user in the ordinary course of operation needs to enter a password, which is the application of information.”¹⁹²

The more difficult question under Section (a)(1), however, is whether the defendant circumvented a technological measure. Alleging that the defendant infringed the copyright of a work that is protected by a technological measure is not, by itself, sufficient to sustain a Section (a)(1) claim.¹⁹³ The statute defines “circumvent a technological measure” as “to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner.”¹⁹⁴ In the IMS case, the court concluded that the plaintiff failed to allege that the defendants circumvented a technological measure.¹⁹⁵ The court reasoned that the plaintiff merely accused the defendant of using a valid password to access the site, and the defendant “is not said to have avoided or bypassed the deployed technological measure in the measure's gatekeeping capacity.”¹⁹⁶ Avoiding permission to use the password, the court reasoned, is not the same as actively circumventing the password technology. The court noted that unlike the CFAA, which prohibits access based on whether it is authorized and injurious, the DMCA is focused on circumventing technology that protects copyrighted content.¹⁹⁷

Indeed, courts have made clear that Section (a)(1) violations do not occur merely because a user violates an agreement. For instance, in Auto Inspection Services, Inc. v. Flint Auto Auction,¹⁹⁸ the plaintiff, Auto Inspection Services, developed software for automobile inspections. One of its former customers, Flint Auto Auction (FAA), developed very similar software. One of the former FAA employees who helped develop the competing software testified that FAA provided him with a printout of Auto Inspection Services's software interface, and instructed him to design the software based on that interface.¹⁹⁹ Auto Inspection Services sued FAA for, among other things, a violation of Section (a)(1), and sought a preliminary injunction to effectively block the use of FAA's software.²⁰⁰ The district court denied this request, concluding that Auto Inspection Services failed to provide any evidence that FAA circumvented a technological measure. Using a printout of a software interface to design competing software, the court held, is not the same thing as accessing source code, modifying the source code, or otherwise creating a derivative software program.²⁰¹

Courts also require Section (a)(1) plaintiffs to allege in their complaints the specific technology that the defendant circumvented, and how that circumvention occurred. For instance, in LivePerson, Inc. v. 24/7 Customer, Inc.,²⁰² LivePerson, which makes real-time interaction software for ecommerce companies, filed a number of claims against 24/7 Customer, a competitor. The two companies had worked together to provide services to some companies, and at one point LivePerson provided 24/7 Customer with a license to use LivePerson's software to serve customers. LivePerson alleges that 24/7 Customer developed competing technology, in part by accessing LivePerson's backend system and copying LivePerson's technology. In its complaint, LivePerson alleged that 24/7 used its access to LivePerson's systems to “observe, penetrate, and manipulate the operation of LivePerson's technology and download extensive data … in order … to reverse engineer and copy LivePerson's technology.”²⁰³ The court noted that LivePerson's complaint does not allege that 24/7 used reverse engineering to circumvent LivePerson's security measures but rather that “LivePerson believes that 24/7 breached its security measures in an effort to reverse engineer and misappropriate the proprietary technology and methodologies that LivePerson pioneered,” an allegation that the court concluded was not specific enough to constitute circumvention under the DMCA.²⁰⁴ The court also rejected LivePerson's assertion that 24/7's alleged mimicking of LivePerson in order to gain access to its system was a violation of Section (a)(7).²⁰⁵ In the cases in which courts have allowed Section (a)(1) claims to proceed, the court noted, the complaints explicitly described the technology that was designed to prevent unauthorized access to a copyrighted material. Merely alleging the circumvention of technology intended to protect copyrighted works, without specifying the technology and how it was circumvented, is insufficient to support a Section (a)(1) claim.

Unlike the CFAA and other statutes, Section (a)(1) does not explicitly require the defendant to have acted in a specific mental state (e.g., “knowingly” or “intentionally”) in order for the statute to apply to that conduct. However, courts generally will not allow a Section (a)(1) claim to move forward unless there is evidence that the defendant actively circumvented a technological measure that was designed to protect copyrighted material. If, for instance, the defendant accessed copyrighted material because the technological measure is not functioning properly, the plaintiff's claim likely will not succeed. In Healthcare Advocates, Inc. v Harding, Earley, Follmer & Frailey,²⁰⁶ a law firm used the Internet Archive's Wayback Machine, www.archive.org, to investigate Healthcare Advocates, a company that was suing the firm's client for trademark infringement. The Wayback Machine archives old versions of publicly available websites. To access the archived content, users type in the web address, and are presented with the dates for which the site has been archived. Healthcare Advocates had placed a robots.txt file on its website, which was intended to prevent the Wayback Machine from archiving its old content. However, due to a malfunction with the Wayback Machine's servers, the previous versions of the Healthcare Advocates website were available when the law firm searched for them. Healthcare Advocates sued the law firm under Section (a)(1), alleging that the firm obtained the archived websites by “hacking.”²⁰⁷ The district court agreed with the plaintiff that, in this context, the robots.txt file constituted a technological measure, as it was intended to prevent public access to archived screenshots of the company's website. However, the court disagreed with Healthcare Advocates – and dismissed the Section (a)(1) claim on summary judgment – because Healthcare Advocates did not provide any evidence that the law firm circumvented the robots.txt file. The court reasoned that the law firm employees had no reason to know that Healthcare Advocates used robots.txt, and therefore “they could not avoid or bypass any protective measure, because nothing stood in the way of them viewing these screenshots.”²⁰⁸

Another common dispute that arises in Section (a)(1) cases is whether the access control that was circumvented protects materials that are covered by U.S. copyright law. A good illustration of this inquiry can be seen in the Eighth Circuit's decision, Davidson & Associates v. Jung.²⁰⁹ The plaintiff, a video game creator, offered an online gaming site, Battle.net, which allowed users to play the CD-ROMs that they purchased in the stores with other players online. To play games with other users on Battle.net, users were required to enter a “CD Key” that was included with CD-ROM games.²¹⁰ The defendants organized the bnetd project, a nonprofit project that emulates Battle.net and allows users to play online. To make their alternative site compatible with the plaintiff's games, they used reverse engineering of the plaintiff's software to test the interoperability.²¹¹ Users were able to access the plaintiff's games on bnetd even if they did not have a valid CD Key.²¹² The plaintiff sued the bnetd developers and organizers under Sections (a)(1) and (a)(2). The plaintiff alleged that the defendants violated Section (a)(1) by circumventing the CD Key requirement, which controlled access to the plaintiff's games.²¹³ The defendants argued that Battle.net is a functional process that is not protected by copyright because it does not constitute creative expression.²¹⁴ The Eighth Circuit rejected this argument and affirmed the district court's ruling that the defendants violated Section (a)(1), reasoning that the only way that the appellants could have accessed the copyrighted material provided through Battle.net was by reverse engineering and circumventing the site.²¹⁵

Section (a)(1) cases often are not as complex as cases involving the other two subsections of the DMCA because the scope is relatively clear. As the U.S. Court of Appeals for the Second Circuit noted in 2001, Section (a)(1) differs from the other two DMCA subsections “in that it targets the use of a circumvention technology, not the trafficking in such a technology.”²¹⁶ As we will see next, the inquiry becomes much more complicated – and courts disagree more frequently – when the alleged DMCA violations arise from trafficking in circumvention technology.

5.3.2.2 DMCA Section 1201(a)(2)

Section 1201(a)(2) states that no person “shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof,” that:

1. “is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access” to a copyrighted work;
2. “is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access” to a copyrighted work; or
3. “is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing a technological measure that effectively controls access” to a copyrighted work”²¹⁷

In short, Section (a)(2) prohibits the trafficking of technology that is used to circumvent controls that protect copyrighted works.²¹⁸ In contrast, Section (a)(1) prohibits the actual act of circumvention of those controls. In the Senate report accompanying the DMCA, the legislators stated that Section (a)(2) would provide a cause of action against a company that manufactured a device that was designed to circumvent a control that only allowed authorized individuals to access the plain text of a copyrighted work.²¹⁹

The primary legal dispute that arises in Section (a)(2) cases is whether the technology trafficked actually facilitates copyright infringement or other violations of rights protected by the Copyright Act. The DMCA does not directly address this issue, though Section 1201(c)(1), somewhat cryptically, states that “[n]othing in this section shall affect rights, remedies, limitations, or defenses to copyright infringement, including fair use, under this title.”²²⁰ Section 1201(c)(1) can be read to merely prevent the anti-circumvention provisions from abrogating existing rights that owners and consumers have under the copyright act, but it also can be read to limit Section 1201's scope only to cases that involve circumvention that leads to actual copyright infringement.

Courts have taken two very different approaches to interpreting the scope and reach of Section (a)(2). Some courts have taken a narrow approach, requiring a nexus between the access that is violated and the protection of copyright. Other courts, in contrast, have held that Section (a)(2) applies to technology that circumvents controls that are used to protect copyrighted content, regardless of whether that technology is actually used to access copyrighted content.

5.3.2.3 DMCA Section 1201(b)(1)

Section (b)(1) states that no person:

shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof that–

1. is primarily designed or produced for the purpose of circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof;
2. has only limited commercially significant purpose or use other than to circumvent protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof; or
3. is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof.²⁵⁴

Section (b)(1) defines “circumvent protection afforded by a technological measure” as “avoiding, bypassing, removing, deactivating, or otherwise impairing a technological measure.”²⁵⁵ The statute states that a technological measure “effectively protects a right of a copyright owner under this title” if the measure, “in the ordinary course of its operation, prevents, restricts, or otherwise limits the exercise of a right of a copyright owner under this title.”²⁵⁶

Section (b)(1) appears to be quite similar to Section (a)(2), as both prohibit trafficking in technology that circumvents technological measures. The primary difference between the two sections is that Section (a)(2) applies to technology that circumvents technological measures that control access to copyrighted works, while Section (b)(1) is narrower, and only applies to technology that circumvents a technological measure that protects against violations of copyright owners' rights – that is, copyright infringement.²⁵⁷ Under the narrow Chamberlain interpretation of Section (a)(2), there is not a substantial difference between Sections (a)(2) and (b)(1), as both sections require a direct link to copyright infringement. However, under the Ninth Circuit's more expansive view of Section (a)(2), the two sections are significantly different, with Section (a)(2) applying broadly to circumvention of technology that protects copyrighted works, regardless of whether the circumvention aids infringement. The Senate Commerce Committee's report accompanying the DMCA indicated its intention for Section (b)(1) to be more narrowly focused on technology that aids copyright infringement.²⁵⁸

Indeed, in MDY, the Ninth Circuit concluded that even though the plaintiff had sufficiently alleged a violation of Section (a)(2) under the court's broad reading of that statute, the plaintiff did not prevail on its claim under Section (b)(1). The court reasoned that its Warden software does not protect against infringement or any other violation of copyright laws, and therefore the circumvention could not violate Section (b)(1).²⁵⁹

If a court finds that a defendant has violated Section (b)(1), the court likely will also find that the defendant has violated Section (a)(2). For example, in Craigslist, Inc. v. Naturemarket, Inc., ²⁶⁰ online classified advertising website Craigslist alleged that defendant Naturemarket developed and distributed software that enabled Naturemarket customers to automatically post multiple ads on Craigslist and to harvest Craigslist user email addresses in order to send spam email messages. Both acts violate Craigslist terms of service, and Craigslist attempts to prevent such automatic posting and harvesting by using a CAPTCHA program and telephone verification, which requires the user to enter a unique code, in an effort to prevent automated programs from accessing the site.²⁶¹ Craigslist alleged that Naturemarket copied portions of Craigslist's website in order to operate and develop its autoposter software. Naturemarket did not respond to Craigslist's complaint, and the district court granted default judgment to Craigslist, concluding that Craigslist's complaint stated valid claims under both Sections (a)(2) and (b)(1). Naturemarket violated Section (a)(2), the court concluded, applying the Ninth Circuit's broad interpretation of the statute, because they trafficked in a product that circumvented CAPTCHA and telephone verification, which “enabled unauthorized access to and copies of copyright-protected portions of Plaintiff's website.”²⁶² The court concluded that because CAPTCHA protected plaintiff's copyright rights in the website, Craigslist stated a viable claim that Naturemarket violated Section (b)(1).²⁶³

In short, regardless of the circuit in which a Section 1201 dispute is adjudicated, a plaintiff who successfully states a Section (b)(1) claim typically also will prevail under Section (a)(2). However, the reverse is not always true. A successful Section (a)(2) claim, particularly in a jurisdiction that adopts the broad MDY reading of the statute, does not necessarily mean that the defendant also violated Section (b)(1), since Section (a)(2) does not require a link to copyright infringement.