New ACLU lawsuit takes on the Internet’s most hated hacking law

For decades, the Computer Fraud and Abuse Act has been one of America’s most dangerous laws for anyone doing "unauthorized" things with a computer. Used to prosecute Aaron Swartz, Sergey Alenikov, and jailbreaker George Hotz, the law has long been criticized as a blank check for prosecutors. Under the law’s current interpretation, anyone breaking a website’s terms of service to collect information is guilty of a federal crime. Now, the American Civil Liberties Union is challenging that.

The group brought a suit against the Department of Justice on behalf of a group of researchers, who say the CFAA is a legal threat to their research. The plaintiffs specialize in algorithmic research: bombarding closed algorithms with a range of different inputs to study their hidden biases. Those techniques often involve breaking a websites terms of service, potentially exposing them to prosecution under the CFAA. "Being able to run socially beneficial studies like ours is at the heart of academic freedom," said the lead plaintiff, University of Michigan professor Christian Sandvig. "We shouldn’t have to fear prosecution just because we’re doing our jobs." The ACLU’s case is based on a First Amendment argument, and even if it succeeds, it would leave many aspects of the CFAA untouched. Legislators have offered a number of bills to restrict the CFAA’s powers, most recently Aaron’s Law in 2013, but so far none have made it through Congress.