Password sharing and the federal anti-hacking law (CFAA)

The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030, makes it a federal offense to access a computer “without authorization” or to exceed “authorized access” and obtain information. So the question for password sharing is whether the system’s owner allowed the access. In United States v. Nosal, former employees whose access had been revoked signed in with a current employee’s password, with her consent. The Ninth Circuit held that they acted without authorization. For a company, that puts the weight on two records: who is allowed to use each login, and when that permission ended.

What the statute says

Section 1030(a)(2) covers anyone who “intentionally accesses a computer without authorization or exceeds authorized access” and thereby obtains information from a protected computer. A protected computer includes one used in or affecting interstate or foreign commerce or communication. Section 1030(a)(4) covers the same access done knowingly and with intent to defraud, when it furthers the fraud and obtains something of value.

The statute defines “exceeds authorized access” in 1030(e)(6). It means accessing a computer with authorization and then using that access to obtain or alter information the person “is not entitled so to obtain or alter.” The Act doesn’t define “without authorization,” a point the Ninth Circuit noted in Nosal.

Section 1030(a)(6) deals with passwords directly. It covers knowingly and with intent to defraud trafficking in any password or similar information through which a computer may be accessed without authorization. That applies if the trafficking affects interstate commerce or the computer is used by or for the federal government.

The CFAA isn’t only criminal. Under 1030(g), a person who suffers damage or loss from a violation may sue. The conduct must involve one of the harms the statute lists, such as a loss of at least $5,000 in one year. The suit must start within two years of the act or of discovering the damage.

Van Buren v. United States (2021)

A police sergeant used his own valid login to search a license-plate database for money, against department policy. He was convicted for exceeding authorized access. The Supreme Court reversed, 6 to 3, in an opinion by Justice Barrett.

The Court held that a person exceeds authorized access when they obtain information from parts of a computer, such as files, folders or databases, that are off-limits to them. It does not cover someone who obtains information they’re allowed to reach, for a bad reason. The Court called this a “gates-up-or-down inquiry”: you either can or can’t enter the system, and either can or can’t enter certain areas inside it.

The Court also pointed to the consequences. The government’s reading would make crimes of everyday conduct, such as sending a personal email from a work computer that policy limits to business use. In footnote 8, it left open whether the limits that count must be technical, or can also come from contracts or policies.

United States v. Nosal (Ninth Circuit, 2016)

Nosal is about a login used after people leave. When an employee left an executive search firm, the firm revoked his computer access. It did the same for two colleagues when they later left to work with him. They kept reaching the firm’s database through his former assistant’s login, which she let them use.

Nosal is a Ninth Circuit decision. That federal appeals court serves Alaska, Arizona, California, Hawaii, Idaho, Montana, Nevada, Oregon and Washington, plus Guam and the Northern Mariana Islands. Van Buren, the Supreme Court case above, was about exceeding authorized access and didn’t address borrowed logins.

The court held that “without authorization” has its ordinary meaning: accessing a protected computer without permission. Once the owner revokes access, the user “cannot sidestep the statute by going through the back door” and using a third party’s login. Permission came from the firm, and the assistant had no authority to override the firm’s decision. The court also said that “authorization is not pegged to website terms and conditions.”

The court stressed that the case was not about password sharing in general. It said the facts bear little resemblance to “asking a spouse to log in to an email account to print a boarding pass.” It also pointed to the intent-to-defraud element as a limit. A dissenting judge read the case as being about password sharing. In his view, the statute does not make the many people who do it unwitting federal criminals.

What the cases look at when a login is shared

These decisions describe the law; they don’t settle any particular arrangement. They do show what a court looks at, and that points to a few practices.

• Decide who is allowed to use each shared login, and write it down. In Nosal, the court looked to the owner of the system, not to whoever held the password.
• When someone leaves, make the end of their access clear and effective. In Nosal, the court noted that the employee had received specific notice that his access was revoked. With a shared password, revoking one person also means changing the password, or the door stays open.
• Don’t let the person holding a password act as the gatekeeper. The assistant’s consent didn’t count in Nosal.
• Treat a service’s terms of use as a separate question. The Ninth Circuit didn’t tie authorization to website terms, and Van Buren left contract limits open. A contract can still limit sharing on its own terms.

When a vendor’s team is the one using a shared login, see What to check when a vendor says its team uses one shared login.