New DOJ CFAA Enforcement Policy Offers Solace To White Hat Computer Security Researchers

For years, courts and commentators have mused about hypothetical Computer Fraud and Abuse Act (CFAA) violations by computer security researchers. On May 19, 2022, the United States Department of Justice (DOJ) published changes to its CFAA enforcement policy, which are effective immediately, addressing these concerns and giving some comfort to white hat security researchers. However, the guidance leaves gray areas, especially when individuals find security flaws and vulnerabilities in businesses that do not offer rewards for information about their findings through a bug bounty program. Likewise, the guidance may incentivize threat actors to pose as bona fide security researchers, meaning businesses must continue to be vigilant in their cybersecurity efforts. The DOJ's updated policy, key considerations for security researchers, and recommendations for businesses are further discussed below.