Appeals court rejects challenge to CFAA anti-hacking law, gives broad leeway to prosecute password theft; critics say ruling may affect routine password sharing
Context & Ripple Effects
This 2016 appellate ruling landed in the middle of an active fight over how far the CFAA reaches into password conduct: courts had been splitting, with one holding that violating an employer's computer-use policy is not a crime under the statute (the EFF-covered December 2015 decision) and another later holding that breaking a site's terms of service alone is not criminal hacking (the March 2020 ruling). By rejecting a constitutional challenge and blessing broad prosecutorial leeway on password theft, this court pushed the other way — and critics immediately flagged that ordinary password sharing sits inside that leeway.
The conflict mattered because it set up exactly the question the Supreme Court took up five years later, when it held the CFAA cannot be used to charge people who misused databases they were otherwise entitled to access (the June 2021 narrowing).
First-order effects
- Federal prosecutors in this circuit gain explicit latitude to bring CFAA charges over password theft — and, per critics cited in the ruling's wake, potentially over password sharing between accounts.
Second-order effects
- The ruling deepens the circuit split with the employer-policy and terms-of-service decisions, raising the stakes for Supreme Court review of where 'unauthorized access' ends.
Third-order effects
- The pattern resolves toward restraint: SCOTUS's 2021 narrowing bars charging people who merely misuse data they are entitled to reach, cutting back precisely the theory of liability this 2016 ruling preserved — while the separate December 2016 expansion of the FBI's warrant-based hacking authority shows enforcement capacity growing even as substantive liability narrows.
The trend: US courts have spent a decade pulling the Computer Fraud and Abuse Act back from criminalizing violations of access rules toward punishing genuine unauthorized intrusion.