DOJ revises computer fraud prosecution standards to ease off 'good

The policy revision instructs prosecutors not to target good-faith security research under the historically fraught law.

Security researchers working in “good faith” to find and expose computer security issues may have less to worry about after the U.S. Department of Justice announced a revision Thursday to its historically broad approach to prosecuting crimes under the Computer Fraud and Abuse Act.

“The policy for the first time directs that good-faith security research should not be charged,” the agency said in a statement, noting that “good faith” in this context refers to accessing a computer solely for purposes of good-faith testing, investigation and/or correction of a security flaw or vulnerability in ways that minimize harm to individuals or the public or promote security and safety.

“Computer security research is a key driver of improved cybersecurity,” Deputy Attorney General Lisa Monaco said in the statement. “The department has never been interested in prosecuting good-faith computer research as a crime, and today’s announcement promotes cybersecurity by providing clarity for good-faith security researchers who root out vulnerabilities for the common good.”

The law, known commonly as the CFAA, emerged in 1984 in the wake of the 1983 thriller ‘WarGames,’ but was fully enacted in 1986. In the film, Matthew Broderick played a teenager who was able to hack into the North American Aerospace Defense Command and nearly cause World War III. In the years since a broad range of legal experts and lawyers have decried the broad applications of the law and how prosecutors used it to charge defendants.

Under the new policy, “hypothetical CFAA violations that have concerned some courts and commentators are not to be charged,” the agency said in the statement.

“However, the new policy acknowledges that claiming to be conducting security research is not a free pass for those acting in bad faith,” the statement continued. “For example, discovering vulnerabilities in devices in order to extort their owners, even if claimed ‘research,’ is not good faith.”

Some pointed to other limitations of the policy shift, from what specific kinds of activities it might cover to how state law might differ.

Perhaps the most notorious CFAA prosecution for the law’s critics was the 2011 indictment of internet activist and pioneer Aaron Swartz, who was charged with 13 felony counts under the law for downloading academic journal papers in an effort to make them free. Swartz faced up to 50 years in prison and a $1 million fine, and he took his own life in 2013 before the trial began.

Bloomberg first reported the policy change, which follows last summer’s Supreme Court ruling that curtailed the scope of CFAA.

Updated, 5/19/22: to include additional outside perspective.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure