US Computer Fraud and Abuse Act Guide: Authorisation, Van Buren and Research Policy

The Computer Fraud and Abuse Act (18 U.S.C. 1030) makes it a federal crime, and a civil wrong, to access a computer "without authorization" or to "exceed authorized access", and whether a security researcher, a tester, an insider or an automated agent has crossed that line now depends on the Supreme Court's 2021 Van Buren decision and the Justice Department's 2022 charging policy. The statute dates from 1986 and covers almost every internet-connected computer. It has no statutory defence for good-faith research; the protection researchers rely on is prosecutorial policy, which does not bind civil claimants or state prosecutors. This guide explains the offences and penalties, how courts now read authorisation, the DOJ policy, civil exposure, the AI agent and machine identity angle, and how to structure testing and disclosure programmes. Status line: statute, DOJ Justice Manual and case law checked on 27 October 2026, with no amendment or policy change found since May 2022. It is for penetration testers, red teams, bug bounty and PSIRT staff, insider risk teams and the counsel who advise them. For the UK equivalent, see the UK Computer Misuse Act Guide.

Key takeaways

• Gates, not purposes. Van Buren (3 June 2021, 6 to 3) held that a person exceeds authorised access by entering areas of a computer, such as files, folders or databases, that are off limits to them, not by misusing data they are entitled to reach.
• Open question on contracts. The Court left open in footnote 8 whether the limits must be technical (code-based) or can come from contracts and policies; DOJ's own policy now requires code or configuration for "exceeds" charges.
• DOJ declines good-faith research. Since 19 May 2022, federal prosecutors should decline cases where the conduct consisted of, and the defendant intended, good-faith security research, but research used to extort owners is not good faith.
• Civil risk remains. Section 1030(g) lets anyone who suffers damage or loss sue, most often on the 5,000 dollar aggregate loss factor, within two years; DOJ policy does not limit these suits.
• Authorisation must be explicit for machines too. Service accounts, found API keys and AI agents act under someone's authority; using a credential you were not given, or letting an agent past the agreed targets, is the classic "without authorization" case.

Scope: who and what is covered

• Protected computer (section 1030(e)(2)): a computer used exclusively by or for a financial institution or the US government (where the conduct affects that use), one used in or affecting interstate or foreign commerce or communication (including certain computers outside the US), or part of a voting system for federal elections. In practice this reaches nearly every networked device, server and cloud service.
• Without authorization: access by someone with no permission to enter the system at all, the outside attacker or a person whose access has been revoked.
• Exceeds authorized access (section 1030(e)(6)): accessing a computer with authorisation and using that access to obtain or alter information the accessor is not entitled to obtain or alter. After Van Buren this is about entering restricted areas, not about motive.
• Damage (section 1030(e)(8)): "any impairment to the integrity or availability of data, a program, a system, or information".
• Loss (section 1030(e)(11)): any reasonable cost to a victim, including responding to the offence, damage assessment, restoration, and lost revenue or consequential damages from interruption of service. Incident response costs count.
• Who: any person, including employees and contractors. The statute excludes lawfully authorised investigative, protective or intelligence activity of US law enforcement and intelligence agencies.

How courts now read authorisation

Key obligations

Like the UK Act, the CFAA prohibits conduct rather than imposing compliance duties. The table summarises the offences in section 1030(a) and first-offence maximum prison terms in section 1030(c).

Attempts and conspiracies are punished as the completed offence. Repeat offences carry higher maxima.

Timeline and current status

The policy is guidance to federal prosecutors and could be changed by a future administration without legislation. Build programmes that rely on clear authorisation, not on prosecutorial discretion.

Enforcement and penalties

Federal prosecution and the 2022 policy

• Good-faith security research defined: the Justice Manual describes it as accessing a computer solely for purposes of good-faith testing, investigation and/or correction of a security flaw or vulnerability, carried out in a manner designed to avoid any harm to individuals or the public, where the information derived is used primarily to promote the security or safety of the class of devices, machines or online services to which the accessed computer belongs, or those who use them.
• What is not good faith: research done to discover security holes in order to extort their owners, even if described as research.
• Limits on charging: "without authorization" cases require that the defendant had no authorisation from anyone able to grant it and knew the facts that made access unauthorised. "Exceeds authorized access" cases require that the computer was divided into areas by code or configuration, not by contracts or policies, and that the defendant knowingly entered a restricted area.
• Trivial terms-of-service breaches: DOJ lists examples it considers insufficient for charges, such as embellishing a dating profile, creating fictional accounts on hiring or housing sites, using a pseudonym where banned, checking sports scores or paying bills at work, and violating an access restriction in a website's terms of service.
• Central oversight: prosecutors must consult the Computer Crime and Intellectual Property Section (CCIPS), and charging against a written CCIPS recommendation requires notice to the Office of the Deputy Attorney General, with its approval needed for "exceeds" charges.

Civil actions

• Who can sue: any person who suffers damage or loss, for compensatory damages and injunctive relief, if the conduct involves one of the factors in section 1030(c)(4)(A)(i)(I) to (V).
• The usual factor: loss to one or more persons aggregating at least 5,000 dollars in a one-year period, in which case damages are limited to economic damages. Incident response and investigation costs can reach that figure quickly.
• Time limit: two years from the act or the discovery of the damage.
• Other claims: companies also use breach of contract, trespass to chattels and copyright, which the CFAA analysis does not settle. State computer crime laws apply separately; as reporting at the time noted, the DOJ policy binds neither state prosecutors nor civil claimants.

What it means for AI agents and non-human identities

Van Buren's gates are, in practice, identity and access controls: authentication, roles, tenant boundaries and API scopes. That makes machine identity design part of what defines lawful access.

• Found credentials are a closed gate: using a leaked API key, cloud access key or token to test whether it works is entering a system with a credential issued to someone else, the clearest "without authorization" fact pattern. Report the exposure instead. See the Secrets Management Guide.
• Scopes and roles are the "areas": a service account or OAuth token that can technically reach a resource is authorised at the code level, but DOJ's policy and Van Buren both look at the areas defined by configuration. Tight scopes make the boundary clear for insiders, partners and testers. See the Service Account Security Guide.
• Autonomous testing agents: an agent that pivots from an in-scope host to a third party's system, or reuses credentials it harvested, can create CFAA exposure for its operator. In July 2026 agents under evaluation by the UK AI Security Institute took 19 out-of-scope actions against real people and projects. See the UK AISI Agent Testing Incident 2026.
• AI scraping and public data: hiQ suggests that collecting public pages without login is generally outside "without authorization", but agents that log in, bypass rate limits or continue after express revocation are on different ground.
• Agent authority records: record which person authorised each agent, for which systems and actions, and log tool calls; that is the evidence of authorisation if access is questioned. See the AI Agent Authorisation Guide.

Compliance steps

For organisations commissioning or running testing

1. Authorise in writing from the right owner. Confirm who controls each target, including cloud and SaaS providers whose terms govern testing of their platforms.
2. Define scope by technical boundary. List hosts, ranges, URLs, tenants, accounts and API scopes, and forbidden actions such as denial of service or data exfiltration. See the Red Team Rules of Engagement Template.
3. Enforce scope in tools and agents. Allow-lists, egress controls, rate limits and a kill switch.
4. Agree data handling. Minimum proof of access, no bulk retrieval, secure storage and deletion.
5. Publish a vulnerability disclosure policy with safe harbour. Commit not to pursue civil or criminal action for good-faith research within the policy, which reduces the civil risk DOJ policy cannot. See the Bug Bounty and Vulnerability Disclosure Guide.
6. Design insider boundaries technically. After Van Buren, policy-only restrictions may not support a CFAA claim against an insider; enforce sensitive boundaries with access controls and keep contractual remedies for the rest.
7. Revoke clearly. When ending access for a person, partner or integration, disable credentials and send an express revocation, since DOJ recognises revocation by unambiguous communication.

For researchers and testers

1. Work within a published programme or written authorisation whenever possible.
2. Stop at proof: do not browse, download or alter data beyond what demonstrates the flaw.
3. Never use credentials you were not issued.
4. Report promptly and never attach payment demands to disclosure.
5. Keep notes showing the purpose and harm-avoidance steps, which mirror the DOJ definition of good faith.

Framework mapping

Detection and measurement

• Engagements started only with signed authorisation naming targets and techniques (target: 100%).
• Out-of-scope requests blocked by scope enforcement per engagement.
• Disclosure reports received through the published channel, and median time to acknowledge.
• Sensitive data stores protected by technical access controls rather than policy alone.
• Time from offboarding or contract end to credential revocation for people, partners and integrations.

Common failure patterns

• Relying on DOJ policy as a shield: the policy addresses federal prosecution only, does not stop civil suits or state charges, and can change.
• Proving impact by going further: downloading records or moving laterally to show severity turns a good-faith finding into obtaining information under section 1030(a)(2).
• Testing leaked credentials: confirming a key works against the live service without the owner's consent.
• Policy-only insider controls: organisations that relied on acceptable use policies to define access find, after Van Buren, that the CFAA may not help against an insider with technical access.
• Unbounded automation: scanners and agents without target allow-lists reaching third-party systems.
• Disclosure that reads as extortion: attaching payment demands or deadlines with threats moves a researcher towards section 1030(a)(7).

Practitioner checklist

• Obtain written authorisation from the legal owner of every target, including cloud and SaaS providers.
• Define scope by technical boundary and enforce it in scanners, agents and test infrastructure.
• Prohibit use of any credential not issued for the engagement.
• Agree minimum-necessary data access and deletion at close.
• Publish a disclosure policy with civil and criminal safe harbour language.
• Enforce sensitive internal boundaries with access controls, not policy alone.
• Revoke access technically and by express notice when relationships end.
• Log agent and automation actions with the authorising principal.
• Recheck the DOJ policy and relevant case law at least yearly.

Standards and references

• Legal Information Institute: 18 U.S. Code 1030, Fraud and related activity in connection with computers
• US Department of Justice: Justice Manual 9-48.000 Computer Fraud and Abuse Act
• US Department of Justice: Department announces new policy for charging cases under the CFAA
• Supreme Court of the United States: Van Buren v. United States, 593 U.S. (2021)
• US Court of Appeals for the Ninth Circuit: hiQ Labs v. LinkedIn (2022)
• The Record: DOJ changes CFAA policy to protect good-faith security research

This guide summarises the US Computer Fraud and Abuse Act, the leading cases and DOJ charging policy as of 27 October 2026 and is not legal advice. Related NHI Mgmt Group resources: UK Computer Misuse Act Guide · Bug Bounty and Vulnerability Disclosure Guide · Penetration Testing Guide · Penetration Test Scoping Checklist