policy memo

There are many federal crimes that might be employed against hackers but, as you know, the most
significant one is the Computer Fraud and Abuse Act (CFAA). The CFAA is codified in Title 18 of the United
States Code (again, the U.S. Code is the compilation of federal statutes organized topically, and Title 18 is the
main place to find federal criminal laws). In particular, it is codified as 18 U.S.C. Section 1030. Click here and
read again—very slowly—the first subsection (1030(a)). As you will see, subsection 1030(a) contains seven
separate criminal offenses. Let that sink in. CFAA is not one criminal prohibition, but seven. Each one could be
a standalone or even a standalone statute. But they aren’t, which above anything else just means that the CFAA
is by itself more impactful than most criminal laws.
Your task here is simple. You are to write a 4-5 page policy brief explaining to me (in the role of an
official just appointed at the Department of Justice) how the CFAA might apply to the prosecution of
cyberterrorists vs. hactivists. Now, for many of you this will be the first time trying to employ a legal statute.
That’s fine! You should go about this by first constructing a hypothetical scenario of cyberterrorist CNA attack
where one (or more!) of the seven elements of the CFAA applies. Then describe to me why the CFAA applies.
Repeat both steps for hactivists. Conclude by offering me your opinion, using what you know about the
cyberterrorist and hactivist enterprises, on how often we (the DoJ) might come across situations where the
CFAA might be brought to bear on these types of non-state actors.