The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030, protects computers in which there is a federal interest—federal computers, bank computers, and computers used in or affecting interstate and foreign commerce. It shields them from trespassing, threats, damage, espionage, and from being corruptly used as instruments of fraud. It is not a comprehensive provision; instead it fills cracks and gaps in the protection afforded by other state and federal criminal laws. It is a work that over the last three decades, Congress has kneaded, reworked, recast, amended, and supplemented to bolster the uncertain coverage of the more general federal trespassing, threat, malicious mischief, fraud, and espionage statutes. This is a brief description of §1030 and its federal statutory companions. There are other laws that address the subject of crime and computers. CFAA deals with computers as victims; other laws deal with computers as arenas for crime or as repositories of the evidence of crime or from some other perspective. These other laws—laws relating to identity theft, obscenity, pornography, gambling, among others—are beyond the scope of this report. In their present form, the seven paragraphs of subsection 1030(a) outlaw computer trespassing in a government computer, 18 U.S.C. 1030(a)(3); computer trespassing resulting in exposure to certain governmental, credit, financial, or computer-housed information, 18 U.S.C. 1030(a)(2); damaging a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce, 18 U.S.C. 1030(a)(5); committing fraud an integral part of which involves unauthorized access to a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce, 18 U.S.C. 1030(a)(4); threatening to damage a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce, 18 U.S.C. 1030(a)(7); trafficking in passwords for a government computer, or when the trafficking affects interstate or foreign commerce, 18 U.S.C. 1030(a)(6); and accessing a computer to commit espionage, 18 U.S.C. 1030(a)(1). Subsection 1030(b) makes it a crime to attempt or conspire to commit any of these offenses. Subsection 1030(c) catalogs the penalties for committing them, penalties that range from imprisonment for not more than a year for simple cyberspace trespassing to imprisonment for not more than 20 years for a second espionage-related conviction and to life imprisonment for death-result offenses. Subsection 1030(d) preserves the investigative authority of the Secret Service. Subsection 1030(e) supplies common definitions. Subsection 1030(f) disclaims any application to otherwise permissible law enforcement activities. Subsection 1030(g) creates a civil cause of action for victims of these crimes. Subsection 1030(h), which has since expired, called for annual reports through 1999 from the Attorney General and Secretary of the Treasury on investigations under the damage paragraph (18 U.S.C. 1030(a)(5)). And subsections 1030(i) and (j) authorize the confiscation of property generated by, or used to facilitate the commission of, one of the offenses under subsection 1030(a) or (b). (a) Whoever ... (3) intentionally, without authorization to access any nonpublic computer of a department or agency of the United States, accesses such a computer of that department or agency that is exclusively for the use of the Government of the United States or, in the case of a computer not exclusively for such use, is used by or for the Government of the United States and such conduct affects that use by or for the Government of the United States ... shall be punished as provided in subsection (c) of this section. (b) Whoever attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section. Paragraph 1030(a)(3) condemns unauthorized intrusion ("hacking") into federal government computers whether they are used exclusively by the government or the government shares access with others. With the help of subsection 1030(b) it also outlaws attempted intrusions and conspiracies to intrude. In the case of shared computers, a crime only occurs if the unauthorized access "affects ... use by or for" the government or would affect such use if an attempted effort had succeeded. Broken down into its elements, paragraph (a)(3) makes it unlawful for anyone to without authorization intentionally either - access a government computer maintained exclusively for the use of the federal government, - access a government computer used, at least in part, by or for the federal government and the access affects use by or for the federal government, - attempts to do so (18 U.S.C. 1030(b)) or - conspires to do so (18 U.S.C. 1030(c)). This pure trespassing proscription dates from 1986 and its legislative history leaves little doubt that nothing more than unauthorized entry is required: "[S]ection 2(b) will clarify the present 18 U.S.C. 1030(a)(3), making clear that it applies to acts of simple trespass against computers belonging to, or being used by or for, the Federal Government. The Department of Justice and others have expressed concerns about whether the present subsection covers acts of mere trespass, i.e., unauthorized access, or whether it requires a further showing that the information perused was 'used, modified, destroyed, or disclosed.' To alleviate those concerns, the Committee wants to make clear that the new subsection will be a simple trespass offense, applicable to persons without authorized access to Federal computers." The paragraph only bans "intentional" trespassing. The reports are instructive here, for they make it apparent that the element cannot be satisfied by a mere inadvertent trespass and nothing more. It is intended, however, to cover anyone who purposefully accomplishes the proscribed unauthorized entry into a government computer, and, at least in the view of the House report, anyone "whose initial access was inadvertent but who then deliberatively maintains access after a non-intentional initial contact." While the question of what constitutes "access without authorization" might seem fairly straightforward, Congress was willing to accept a certain degree of trespassing by government employees in order to protect whistleblowers: The Committee wishes to be very precise about who may be prosecuted under the new subsection (a)(3). The Committee was concerned that a Federal computer crime statute not be so broad as to create a risk that government employees and others who are authorized to use a Federal Government computer would not face prosecution for acts of computer access and use that, while technically wrong, should not rise to the level of criminal conduct. At the same time, the Committee was required to balance its concern for Federal employees and other authorized users against the legitimate need to protect Government computers against abuse by "outsiders." The Committee struck that balance in the following manner. In the first place, the Committee has declined to criminalize acts in which the offending employee merely 'exceeds authorized access' to computers in his own department ("department"' is defined in [s]ection 2(g) of S. 2281 [now 18 U.S.C. 1030(e)(7)]). It is not difficult to envision an employee or other individual who, while authorized to use a particular computer in one department, briefly exceeds his authorized access and peruses data belonging to the department that he is not supposed to look at. This is especially true where the department in question lacks a clear method of delineating which individuals are authorized to access certain of its data. The Committee believes that administrative sanctions are more appropriate than criminal punishment in such a case. The Committee wishes to avoid the danger that every time an employee exceeds his authorized access to his department's computers—no matter how slightly—he could be prosecuted under this subsection. That danger will be prevented by not including "exceeds authorized access" as part of this subsection's offense. In the second place, the Committee has distinguished between acts of unauthorized access that occur within a department and those that involve trespasses into computers belonging to another department. The former are not covered by subsection (a)(3); the latter are. Again, it is not difficult to envision an individual who, while authorized to use certain computers in one department, is not authorized to use them all. The danger existed that S. 2281, as originally introduced, might cover every employee who happens to sit down, within his department, at a computer terminal which he is not officially authorized to use. These acts can also be best handled by administrative sanctions, rather than by criminal punishment. To that end, the Committee has constructed its amended version of (a)(3) to prevent prosecution of those who, while authorized to use some computers in their department, use others for which they lack the proper authorization. By precluding liability in purely 'insider' cases such as these, the Committee also seeks to alleviate concerns by Senators Mathias and Leahy that the existing statute cases a wide net over "whistleblowers".... The Committee has thus limited 18 U.S.C. 1030(a)(3) to cases where the offender is completely outside the Government, and has no authority to access a computer of any agency or department of the United States, or where the offender's act of trespass is interdepartmental in nature. The Committee does not intend to preclude prosecution under this subsection if, for example, a Labor Department employee authorized to use Labor's computers accesses without authorization an FBI computer.