SCOTUS narrows the scope of Computer Fraud and Abuse Act, ruling it can't be used to charge people who misused databases they are otherwise entitled to access
The justices agreed with a broad range of critics that prosecutors had been misusing the 35-year-old law. — The U.S. Supreme Court building is shown.
Context & Ripple Effects
This ruling closes a loop that has been running since at least 2016, when an appeals court gave prosecutors broad leeway to pursue password theft under the CFAA — a decision critics warned could criminalize routine password sharing. The law's vagueness kept drawing fire: in March 2020 a federal court ruled that merely violating a site's terms of service is not criminal hacking, and when SCOTUS took up the question in late 2020, Justice Gorsuch warned that the government's reading risked 'making a federal criminal of us all.'
First-order effects
- Prosecutors lose the ability to charge people who misused databases they were otherwise entitled to access — the 'authorized user who exceeds intended use' category of CFAA prosecution is now off the table.
- Defendants currently charged on that basis gain a judicially sanctioned argument that their conduct falls outside the statute, reshaping ongoing cases against authorized insiders.
Second-order effects
- Companies that leaned on CFAA exposure to police employee or partner data misuse must fall back on contract law, civil litigation, and access-revocation rather than criminal referral.
- Courts and the DOJ must redraw charging guidelines around the narrower line between unauthorized access and misuse of granted access, creating interpretive work across every pending computer-crime case citing the statute.
Third-order effects
- Enforcement of acceptable-use boundaries shifts structurally from a 1986 criminal statute toward private contractual mechanisms and civil remedies — unless Congress moves to update the law to close the gap the Court just opened.
- If Gorsuch's 'federal criminal of us all' concern proves to be the Court's through-line, further narrowing of vague cyber statutes becomes plausible, raising the bar for what counts as a prosecutable computer crime.
The trend: Federal computer-crime liability is contracting from sweeping statutory breadth toward a narrow definition of true unauthorized access, leaving acceptable-use enforcement to contracts and civil law.