DOJ Clarifies It Won't Charge Good-Faith Cybersecurity Research With Violating CFAA

On May 19, the US Department of Justice (DOJ) announced a revised policy regarding charging violations of the Computer Fraud and Abuse Act (CFAA), directing its prosecutors not to charge "good-faith" computer security research. In the announcement, Deputy Attorney General Lisa Monaco noted that "[c]omputer security research is a key driver of improved cybersecurity." DOJ "has never been interested in prosecuting good-faith computer security research as a crime," she continued, and "today's announcement promotes cybersecurity by providing clarity for good-faith security researchers who root out vulnerabilities for the common good."

The revised policy defines "good-faith security research" as "accessing a computer solely for purposes of good-faith testing, investigation, and/or correction of a security flaw or vulnerability," under two conditions. First, the activity must be "carried out in a manner designed to avoid any harm to individuals or the public." And secon