What is unauthorized access under the CFAA?
- Term
- Unauthorized access (CFAA)
- Meaning
- Under the federal anti-hacking law, the CFAA, unauthorized access means entering a computer "without authorization" or going past the access you were given.
Unauthorized access is the core of the crimes in the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030. The statute uses two phrases. One covers people who access a computer “without authorization.” The other covers someone who has access and “exceeds authorized access.” Which phrase fits depends on whether the person was allowed into the system at all.
What do the two phrases mean?
The basic offense, in 1030(a)(2), is getting information through either kind of access. Only the second phrase has a definition, in 1030(e)(6): the person was allowed to use the computer, then used it to get or change information they had no right to. Nothing in the statute defines “without authorization.”
In Van Buren v. United States (2021), the Supreme Court read “without authorization” as being kept out of a system entirely. It read “exceeds authorized access” as entering a part of it you aren’t allowed into, such as a file or database. It didn’t cover misusing information you’re allowed to reach. The holding, and how it applies to shared passwords, is covered in password sharing and the federal anti-hacking law.
Where does a former employee fit?
Van Buren was about a current employee, not a former one, and it didn’t decide this. Read in its terms, a person whose permission has been ended is shut out of the system. That points to the first phrase, “without authorization.” The same password-sharing page covers a federal appeals court case on former employees.
So two facts a company can show carry weight: who was allowed into each system, and the date that permission ended.
What do the damage offenses add?
Section 1030(a)(5) covers damage to a protected computer, such as deleting accounts or data. A case where a fired IT worker deleted a school district’s accounts shows the kind of conduct it reaches. It has three parts:
- (A) Knowingly sending a program, information, code or command, and as a result intentionally causing damage without authorization.
- (B) Intentionally accessing a protected computer without authorization, and as a result recklessly causing damage.
- (C) Intentionally accessing a protected computer without authorization, and as a result causing damage and loss.
The text of (A) has no access element. It asks whether the damage was authorized, not the access. “Damage,” defined in 1030(e)(8), covers harm to whether data, programs, systems or information are intact and available. “Loss” under 1030(e)(11) means any reasonable cost to a victim, including the cost of responding to the offense.
Current and former staff who misuse access are insiders, defined in what is an insider threat?
Frequently asked questions
Does the CFAA define "without authorization"?
No. Section 1030(e) defines "exceeds authorized access" but not "without authorization." Van Buren treats the phrase as asking whether you may enter the computer system at all.
Did Van Buren make it legal to misuse access you already have?
No. It held that "exceeds authorized access" doesn't reach someone who gets information they're allowed to reach, for a bad reason. The damage offenses in 1030(a)(5) are separate provisions.
Does deleting files count as damage under the CFAA?
Section 1030(e)(8) defines damage as harm to whether data, programs, systems or information are intact and available. Deleted files are no longer available.
How Junify handles this
- Doing this by hand
- To avoid the same kind of incident, you stop every login a person could use each time they leave or a contract ends. You change the shared passwords they knew and send the new ones to everyone who stays. And someone has to check the sign-in records on a regular schedule.
- With Junify
- Under the CFAA, what counts is who the owner allowed into each account and when that ended. With Junify, the admin decides who may open each account, people verify on their own phone first, and each use is recorded by person. People never see the password, so once the admin removes someone's access in Junify, they have nothing to sign in with later.
Sources
- 18 U.S.C. 1030, Fraud and related activity in connection with computers (govinfo, United States Code 2023 edition)
- Supreme Court of the United States: Van Buren v. United States, No. 19-783 (June 3, 2021), slip opinion
-
A vendor's stolen login opened a retailer's network (2013) and what it shows about vendor remote access
A Senate staff report says attackers stole a contractor's login through infected email and used it to enter a national retailer's network.
-
Vendor call-center staff opened 68,701 customer accounts without authorization (2014) and what it shows about reviewing vendor access
For 168 days, three workers at a carrier's call-center vendor opened 68,701 customer accounts without authorization and collected personal details.
-
A former contractor used a shared cloud admin key (2018) and what it shows about shared admin logins
An online education company shared one full-access cloud key with staff and contractors. A former contractor used it to take data on about 40 million users.