A US federal court rules that simply breaking a site's terms of service does not constitute criminal hacking under the Computer Fraud and Abuse Act
Courts have struggled to interpret the vague Computer Fraud and Abuse Act. — A federal court in Washington, DC, has ruled that violating …
Context & Ripple Effects
The Computer Fraud and Abuse Act has been a patchwork for years because its language never clearly separated criminal hacking from ordinary contract-breaking. Courts have already pulled back at the edges: in 2015 an appeals court held that violating an employer's computer-use policy is not a crime, while a 2016 appellate decision went the other way on credentials, giving prosecutors broad leeway to pursue password theft.
This Washington, DC ruling extends the first line of cases from workplace policies to website terms of service, drawing a sharper line between breaching a site's rules and actually circumventing technical access controls. It matters because sites have long written ToS clauses that criminalize scraping, research, and automated access — conduct that now sits outside federal hacking law.
First-order effects
- Federal prosecutors lose their ability to charge ToS violations as CFAA crimes in this court's jurisdiction, which directly protects security researchers, scrapers, and anyone whose only 'offense' was breaking a site's written rules.
- Companies that relied on the CFAA's criminal shadow to deter unwanted access must fall back on civil suits, blocking, and rate-limiting rather than threatening prosecution.
Second-order effects
- The split with the 2016 password-theft ruling deepens the circuit conflict over where 'unauthorized access' begins, pressuring higher courts to reconcile whether credentials, not contracts, define authorization.
- Platforms seeking legal teeth against scrapers will shift toward technical enforcement and civil litigation under copyright or contract law, as seen when Cloudflare faced — and defeated — a liability claim between websites using its services.
Third-order effects
- If the pattern holds, the CFAA converges on a technical definition of hacking — circumventing real barriers like passwords and paywalls — with the Supreme Court's later move to stop charging people who misused databases they were entitled to access confirming exactly that trajectory.
- Congress faces growing pressure to rewrite the statute explicitly, since case-by-case judicial narrowing leaves a vague felony law whose application depends on which court hears the case.
The trend: Courts are steadily redefining the CFAA around genuine technical circumvention rather than breached policies, converting a broad anti-hacking statute into a narrow one.