The CFAA And The Insider Threat

Last week Rep. Zoe Lofgren introduced " Aaron's Law," legislation that would significantly amend the Computer Fraud and Abuse Act (CFAA). The proposed bill, drafted by Rep. Lofgren and Sen. Ron Wyden, is named in honor of the late Aaron Swartz, who took his own life earlier this year while under indictment for CFAA charges. The bill seeks to narrow a broadly written provision of the CFAA that criminalizes "exceed[ing] authorized access" to a computer system. But however well-intentioned the bill might be, it would essentially gut the provisions of the CFAA that are used for "insider" computer attacks and would make it effectively impossible to use the CFAA to prosecute, or to bring civil suits based on, insider thefts of intellectual property or other proprietary business information.