This case is about password sharing. People frequently share their passwords, notwithstanding the fact that websites and employers have policies prohibiting it. In my view, the Computer Fraud and Abuse Act (“CFAA”) does not make the millions of people who engage in this ubiquitous, useful, and generally harmless conduct into unwitting federal criminals. Whatever other liability, criminal or civil, Nosal may have incurred in his improper attempt to compete with his former employer, he has not violated the CFAA. — Judge Stephen Reinhardt, Ninth Circuit Court of Appeals 
 
 Clearly, Judge Reinhardt is concerned that his decision could open up the possibility of friends sharing Netflix or HBO GO passwords could constitute a federal crime. He continues, noting that his fellow judges claim that they do not have to address the effect of their decision on the wider population because Nosal’s infelicitous conduct “bears little resemblance” to everyday password sharing. 
 
 Continuing on, Reinhardt concludes that the majority decision from the two other judges “does not provide, nor do I see, a workable line which separates the consensual password sharing in this case from the consensual password sharing of millions of legitimate account holders, which may also be contrary to the policies of system owners.” 
 
 What does it mean for you? 
 
 According to this ruling, it seems that anyone sharing a password “without authorization” could potentially be convinced of violating the CFAA. 
 
 That being said, don’t expect the FBI to come knocking next time you stream on your boyfriend’s account. There remains some vagueness in what “without authorization” means. While providers like Netflix and HBO GO officially say that logins shouldn’t be shared, some, including Netflix, have publicly stated that account sharing is OK, a statement that would presumably kill any “without authorization” argument if for some reason someone was prosecuted for sharing their Netflix account. 
 
 Plus, this assumes that the government or a company would prosecute or sue a user for sharing passwords in the first place. The odds that you would face any legal repercussions right now for password sharing is extremely slim, especially because entertainment providers have taken a laissez-faire approach to password-sharing enforcement. 
 
 That being said, a small possibility remains that down the line one company may want to make an example out of someone, similar to how a select few individuals were sued for pirating music. But until that happens, it’s safe to assume that you won’t find yourself in a federal court for giving your girlfriend your HBO GO login. ||||| On July 5th , the U.S. Ninth Circuit Court of Appeals issued an opinion which found, in part, that sharing passwords is a crime prosecutable under the Computer Fraud and Abuse Act (CFAA). The decision, according to a dissenting opinion on the case, makes millions of people who share passwords for services like Netflix and HBOGo into “unwitting federal criminals.” 
 
 The decision came in the case of David Nosal, an employee at the executive search (or headhunter) firm Korn/Ferry International. Nosal left the firm in 2004 after being denied a promotion. Though he stayed on for a year as a contractor, he was simultaneously preparing to launch a competing search firm, along with several co-conspirators. Though all of their computer access was revoked, they continued to access a Korn/Ferry candidate database, known as Searcher, using the login credentials of Nosal’s former assistant, who was still with the firm. 
 
 Nosal was eventually charged with conspiracy, theft of trade secrets and three counts under CFAA, and was sentenced to prison time, probation, and nearly $900,000 in restitution and fines. 
 
 Nosal’s conviction under CFAA hinged on a clause that criminalizes anyone who “knowingly and with intent to defraud, accesses a protected computer without authorization”. Though CFAA is often understood to be an anti-hacking law, that clause in particular has been applied to many cases that fall far short of actual systems tampering. 
 
 CFAA has, for instance, been used to prosecute violation of Terms of Service agreements (which are themselves a contested practice ). Most notoriously, the law was used to pursue Aaron Swartz, the young programmer who committed suicide after being charged with mass-downloading research papers from an MIT database, in violation of its terms of service—despite the fact that he was then a research fellow at MIT, with authorized access to the involved database. 
 
 Because of cases like this, The New Yorker ’s Tim Wu has described the CFAA as “ the worst law in technology “. 
 
 One of the Ninth Circuit judges, Stephen Reinhardt, seemed to agree with those interpretations in his dissenting opinion. While Reinhardt took no issue with Nosal’s convictions on trade secrets violations, he said the new decision also makes “consensual password sharing” a prosecutable offense. Reinhardt noted that the decision “loses sight of the anti-hacking purpose of the CFAA, and . . . threatens to criminalize all sorts of innocuous conduct engaged in daily by ordinary citizens.” 
 
 Innocuous conduct like letting bae use your Netflix account, or giving your bestie your HBO Go login to stream Lemonade or the Game of Thrones . 
 
 This article originally appeared on Fortune.com
– Have you ever used a shared password for Netflix, Hulu, or HBO GO? If so, you might now be an "unwitting federal criminal" thanks to an appeals court's finding that people who share passwords are subject to prosecution under the Computer Fraud and Abuse Act, or CFAA, Time reports. The July 5 decision stems from the case of David Nosal, an employment recruiter who used his former assistant's password (with that employee's permission) to access the candidate database of his former employer as he prepared to launch a competing firm. Ultimately, Nosal was sentenced to prison and fined nearly $900,000 for conspiracy and theft of trade secrets, along with three CFAA violations—namely, using the assistant's password to access data "without authorization" from the company. The ruling by the Ninth Circuit Court of Appeals could make "password sharing among friends and family" a federal crime, Judge M. Margaret McKeown writes in the majority opinion, per TechCrunch. However, she adds, “the reality is that facts and context matter in applying the term ‘without authorization.'” In his dissent, Judge Stephen Reinhardt writes that, Nosal's other crimes notwithstanding, he did not violate the CFAA by using a shared password, adding that the traditionally anti-hacking law "does not make the millions of people who engage in this ubiquitous, useful, and generally harmless conduct into unwitting federal criminals." As TechCrunch notes, "don’t expect the FBI to come knocking next time you stream on your boyfriend’s account," as the court's decision leaves "without authorization" open to interpretation and allows for context to be considered. But someday, it adds, a company may want to make an example of someone for sharing a password.