The Computer Fraud and Abuse Act: How WarGames Shaped US Law

In the early 1980s, there was hardly any law against breaking into a computer. Prosecutors had to stretch older statutes about wire fraud or theft to fit cases that did not match them well. The law that eventually filled the gap, the Computer Fraud and Abuse Act of 1986, was shaped by a Hollywood film, a group of teenagers and a Congress that suddenly realised how little it understood.

WarGames and the 414s

WarGames was released in June 1983. In it, a teenager played by Matthew Broderick uses a home computer and a modem to connect to a military system and nearly triggers a nuclear confrontation. It was fiction, but it landed at the right moment. According to widely repeated reporting, President Reagan watched the film and afterwards asked his advisers whether such a thing could really happen. The answer he received led to a review of the security of government computers.

The same summer, real events supported the anxiety. A group of teenagers from Milwaukee, who called themselves the 414s after their area code, were found to have entered computer systems at institutions including Los Alamos National Laboratory and the Sloan-Kettering Cancer Center. They had done it with home computers, modems and guessed passwords. They became national news, and members testified before a congressional committee.

The first law, and why it was not enough

In 1984, Congress passed the Comprehensive Crime Control Act, which included a first federal provision on computer crime. It was narrow. It focused mostly on access to classified government information and to certain financial records. Many cases that worried the public, such as unauthorised access to private company systems, were not clearly covered.

Lawmakers recognised the gap. In 1986 they passed the Computer Fraud and Abuse Act, which amended the existing section and widened its reach considerably.

What the 1986 act did

• It made it a crime to access certain protected computers without authorisation, or to exceed authorised access.
• It covered computers used by the federal government and by financial institutions, along with other computers of federal interest.
• It created offences for causing damage, trafficking in passwords, and obtaining information through unauthorised access.
• It added penalties that scaled with the severity and the intent of the offence.

Over the years the law has been amended several times, including in 1994, in 1996 and again in 2001 through the USA PATRIOT Act. Its coverage grew until it effectively applied to almost every computer connected to the internet.

The first big test

The new law's first widely known prosecution came after the Morris worm in 1988. Robert Tappan Morris was convicted by a jury in 1990 under the act, which made his case a landmark. It showed that the statute applied to a program that did not steal anything or aim at a specific victim, but spread widely and caused damage in the process. That story has its own article in this series.

The United States was not alone in struggling with the question. Throughout the late 1980s and 1990s, other countries wrote their own computer misuse laws. The United Kingdom passed the Computer Misuse Act in 1990, which created offences for unauthorised access and for modifying computer material without permission. In 2001 the Council of Europe opened the Budapest Convention on Cybercrime for signature, which tried to align national laws and make cross-border investigation easier. Each of these laws faced the same difficulty: describing in legal terms what it means to use a computer in a way the owner did not allow.

That difficulty is not purely academic. It is what makes a clear, written policy about who may do what on your systems so valuable. When the line between permitted and prohibited use is written down, it is far easier to explain when someone has crossed it.

Criticism and reform

The wording of the CFAA has long been controversial. The phrase "exceeds authorized access" was criticised as vague. Critics said it could turn breaches of a website's terms of service into potential federal crimes. The case of Aaron Swartz, who faced federal charges in 2011 after downloading a large number of academic articles from the JSTOR service at MIT, became a symbol of that concern.

In 2021, the US Supreme Court addressed part of the question in Van Buren v. United States. It ruled that the phrase applies to people who access areas of a computer system that are off limits to them, and not to people who have access to the data but use it for an improper purpose. The decision narrowed the law somewhat, though debate about its scope continues.

Law and security are two halves of the same problem. Technical defences stop most attacks, but they do not deter anyone who feels safe from consequences. Laws provide the deterrent and the framework for investigation, but they are only useful if victims can prove what happened. That is a practical point for site owners: if your site is attacked, the quality of your records often decides whether anyone can do something about it.

The lesson for site owners today

Treat logging as a security feature. Keep access and error logs. Know who has an account on your site and what each account can do. Remove users who no longer need access. Write down who is authorised to do what, because the legal idea of authorisation depends on it, and so does your own ability to notice when someone has stepped outside it.

• Give each person their own login instead of sharing one.
• Grant only the permissions a person needs.
• Review accounts when staff or contractors leave.
• Keep logs long enough to investigate a problem after the fact.

Practical how-to guides are collected in the knowledgebase.

Putting it into practice

Plesk, which is included on every Zebra Hosting plan, lets you create separate users and limit what they can reach. If you want a clearer picture of how we approach protecting accounts, see our security page, or browse the knowledgebase for guides on managing access.