Appeals court rejects challenge to CFAA anti-hacking law, gives broad leeway to prosecute password theft; critics say ruling may affect routine password sharing
Context & Ripple Effects
This ruling landed mid-stream in a running judicial fight over how far the CFAA reaches. Courts had been trimming the statute's edges — an appeals court held in late 2015 that merely violating an employer's computer-use policy is not a crime, and a federal court later ruled that breaking a site's terms of service is not criminal hacking either.
Against that backdrop, this decision cuts the other way: by rejecting a constitutional challenge and blessing broad prosecutorial leeway on password theft, it keeps credential misuse inside the statute even as other uses fall outside it — a tension the Supreme Court would only resolve years later when it [[a:967004|narrowed the CFAA so it cannot charge people who misuse databases they are otherwise entitled to access]].
First-order effects
- Federal prosecutors retain wide latitude to bring CFAA charges for password theft, since the court declined to impose limits on how the anti-hacking law is applied.
- Critics' warning lands on ordinary users: conduct as common as sharing login credentials now sits closer to criminal exposure under this reading.
Second-order effects
- The ruling deepens a circuit-level split with decisions holding that policy or terms-of-service violations alone are not crimes, leaving liability for computer misuse inconsistent depending on jurisdiction and conduct.
- Online services and employers gain a stronger legal backstop to threaten or pursue users over credential handling, shifting leverage in disputes over account access.
Third-order effects
- If the pattern holds, overbroad CFAA readings keep provoking correction from higher courts — culminating in the Supreme Court confining the statute to access a person is not entitled to at all, rather than misuse of permitted access.
- That trajectory pushes Congress toward clarifying legislation, since prosecutors and defendants alike are left navigating a patchwork of conflicting appellate interpretations.
The trend: American courts spent the decade oscillating over the CFAA's reach, with this pro-prosecution password-theft ruling ultimately overtaken by the Supreme Court's narrowing of the statute to unauthorized access.