Lesson 2.2

Computer Crime and Privacy Laws

Not legal advice. This is an educational overview for an ethical hacking class. Laws differ by country and state, change often, and apply differently to different facts. Anyone doing real engagements should get guidance from their employer’s legal team or a qualified attorney.

Learning Objectives

After this, students can explain what the Computer Fraud and Abuse Act (CFAA) prohibits and how Van Buren v. United States narrowed it.
After this, students can walk through the hiQ Labs v. LinkedIn case and explain why “probably not a crime” still ended badly for hiQ.
After this, students can explain why “publicly available” does not mean “free to use” under privacy laws like the GDPR and CCPA/CPRA.
After this, students can identify where OSINT work can cross into other laws: FCRA, voter data rules, access device fraud, stalking, and doxxing laws.

The Big Picture

Most OSINT is legal. Reading public web pages, searching public records, and looking up DNS records are things millions of people do every day. The legal risk shows up in three places:

How you get the information. Getting past a login, using someone else’s credentials, or ignoring a technical block can turn research into unauthorized access.
What the information is. Personal data, especially sensitive data, is regulated in many places even when it’s public.
What you do with it. Compiling information to harass, stalk, or intimidate someone is a crime even if every individual piece was public.

The rest of this file walks through the main laws behind each of those.

The Computer Fraud and Abuse Act (CFAA)

What it is

The CFAA (18 U.S.C. § 1030) is the main US federal computer crime law, originally passed in 1986. Its core idea is that you commit a crime when you access a computer:

“without authorization” — typically outsiders who have no permission at all, or
“exceeding authorized access” — typically insiders who have some permission but go beyond it.

The CFAA also lets companies file civil lawsuits against people who violate it, which is why it shows up so often in scraping disputes between businesses.

For years, courts disagreed about what “exceeds authorized access” meant. A broad reading said you exceed your access whenever you use information for a purpose your employer or a website doesn’t allow. Under that reading, violating a website’s terms of service or checking personal email at work could arguably be a federal crime. A narrow reading said it’s only about where you go in a system, not why.

Van Buren v. United States (2021)

Facts: Nathan Van Buren, a Georgia police sergeant, was allowed to use a law enforcement license plate database for work. He ran a plate search in exchange for money (it was an FBI sting) and was convicted under the CFAA for exceeding authorized access.
Decision: On June 3, 2021, the Supreme Court reversed his conviction in a 6–3 decision.
Holding: Someone “exceeds authorized access” when they access a computer with authorization but then obtain information from particular areas of the computer (such as files, folders, or databases) that are off-limits to them. Misusing information you were allowed to access, for a bad reason, is not what this part of the CFAA covers.
The “gates-up-or-down” test: The Court described both CFAA clauses as a gates-up-or-down inquiry. Either you’re allowed through a gate (into the system, or into a specific part of it) or you aren’t. Your motive doesn’t change the answer.
Open question: The Court left open whether those “gates” must be technical barriers (like passwords) or can also be set by contracts and policies.

Why it matters for OSINT: After Van Buren, reading information you’re allowed to see is much less likely to be a CFAA crime just because you’re using it for a purpose the site owner doesn’t like. But going through a gate you weren’t given (logging into someone else’s account, reaching an admin panel, accessing a restricted database) is still squarely covered.

hiQ Labs v. LinkedIn (2017–2022)

This is the most important scraping case for OSINT students, because it shows both what the CFAA doesn’t cover and why that isn’t the end of the story.

When	What happened
2017	hiQ, a data analytics company, scraped public LinkedIn profiles to sell workforce analytics. LinkedIn sent a cease-and-desist letter and added technical blocks. hiQ sued, and the district court issued a preliminary injunction letting hiQ keep scraping.
2019	The Ninth Circuit upheld the injunction, suggesting that scraping public profiles likely isn’t access “without authorization” under the CFAA.
2021	The Supreme Court vacated that decision and sent it back for reconsideration in light of Van Buren.
April 2022	The Ninth Circuit reaffirmed its earlier ruling.
November 2022	The district court ruled that hiQ breached LinkedIn’s User Agreement through (1) automated scraping of LinkedIn profiles and (2) hiring crowdsourced workers (“turkers”) to create fake profiles to access the platform.
December 2022	The parties settled. hiQ agreed to a consent judgment that included a permanent injunction to stop scraping, deletion of the scraped data, source code, and algorithms, $500,000 in damages to LinkedIn, and a stipulation that LinkedIn could establish liability under the CFAA and California’s state equivalent, plus trespass to chattels and misappropriation.

Lessons:
- Scraping public data may not be a federal crime, but contract law (terms of service) still applies, especially when you have an account and agreed to the terms.
- Fake accounts turned a debatable case into a clear breach of contract.
- Winning on the CFAA question didn’t save the company. hiQ still ended up paying, deleting its data, and stopping the practice.

The 2022 DOJ charging policy

On May 19, 2022, the Department of Justice updated its policy for charging CFAA cases:

Federal prosecutors should decline to prosecute good-faith security research, defined as accessing a computer solely for good-faith testing, investigation, and/or correction of a security flaw, done in a way designed to avoid harm, with the information used to promote security.
The policy also says that certain everyday terms-of-service violations are not, by themselves, enough for federal charges. Its examples include embellishing an online dating profile contrary to the site’s terms, creating fictional accounts on hiring, housing, or rental websites, using a pseudonym on a social networking site that prohibits them, checking sports scores or paying bills at work, and violating an access restriction contained in a term of service.

Important limits: This is a prosecution policy, not a change to the law. It does not protect you from civil lawsuits under the CFAA, and it does not apply to state computer crime laws. “Good faith” is also judged by prosecutors, not by you.

Sandvig v. Barr (2020)

A group of academics and journalists wanted to create fake accounts on hiring websites to test whether the sites’ algorithms discriminated by race or gender, which would violate those sites’ terms of service. They challenged the CFAA before doing the research. In 2020, a federal court in Washington, D.C. concluded that the CFAA does not criminalize mere terms-of-service violations on consumer websites, and that their planned research wasn’t criminal under the CFAA. (Breach of contract claims by the websites would be a separate question.)

State Computer Crime Laws

According to the National Conference of State Legislatures, all 50 states, Puerto Rico, and the US Virgin Islands have computer crime laws, and most address unauthorized access or “computer trespass.” These laws:

Can be broader than the CFAA, and don’t necessarily follow Van Buren’s narrow reading.
Are not covered by the DOJ’s federal charging policy.
Often include civil remedies that let companies sue.

Before doing anything that touches a system (even lightly), know which state’s law applies. It can depend on where you are, where the target is, and where the server is.

A Brief International Note

United Kingdom — Computer Misuse Act 1990 (CMA): Section 1 makes unauthorised access to computer material an offence. Section 3A (added in 2006) covers making, supplying, or obtaining “articles” (programs or data) for use in computer misuse offences. Security researchers have argued for years that the CMA lacks protection for legitimate research, and reform has been debated repeatedly (check the current status of CMA reform before class).
Everywhere else: Most countries have their own computer crime laws, and the Council of Europe’s Budapest Convention on Cybercrime has pushed many toward similar definitions (verify before class). If your target, your client, or you are outside the US, US law is not the only law that matters.

Privacy Law: “Public” Is Not a Loophole

The General Data Protection Regulation protects personal data: any information relating to an identifiable person. The key points for OSINT:

Publicly available personal data is still personal data. Public availability makes data easier to reach, but it doesn’t remove GDPR obligations like having a lawful basis, being transparent, and respecting people’s rights.
Article 14 requires organizations to inform people when their data was collected from somewhere other than the person themselves (like public registers or websites), with limited exceptions such as when notice would be impossible or require disproportionate effort.
Example: In March 2019, Poland’s data protection authority fined Bisnode Polska about PLN 943,000 (roughly €220,000) for not informing about 6.6 million people that it was processing their data, which it had taken from public registers. Posting a notice on its website was not enough.
Article 9 sets stricter rules for “special categories” of data: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify someone, health data, and data about a person’s sex life or sexual orientation. There is an exception for data “manifestly made public” by the person, but the rest of the GDPR still applies.
Reach: The GDPR can apply to organizations outside the EU when they monitor the behavior of people in the EU.
Example — facial recognition: On September 3, 2024, the Dutch Data Protection Authority announced a €30.5 million fine against Clearview AI (decision dated May 16, 2024) for building a biometric database from photos scraped from the internet, including photos of people in the Netherlands.

Regulators have also published guidance on web scraping. For example, France’s CNIL has issued guidance on scraping and reusing publicly available online data.

CCPA / CPRA (California)

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents rights over personal information that covered businesses hold about them.

The law excludes “publicly available” information from its definition of personal information. Under the original CCPA, that mostly meant information lawfully made available from government records.
The CPRA expanded that exclusion to include information a business reasonably believes was lawfully made available to the general public by the consumer or through widely distributed media, and information the consumer shared without restricting it to a specific audience.
The exclusion does not cover biometric information collected about someone without their knowledge.

Takeaway: US state privacy laws are more permissive than the GDPR about public data, but they vary by state, and other US states have passed their own privacy laws with different definitions. Check which ones apply.

The Fair Credit Reporting Act (FCRA) and People-Search Data

The FCRA regulates consumer reports: information used to make decisions about people’s eligibility for things like employment, housing, credit, and insurance. Companies that assemble that information for those purposes are consumer reporting agencies with legal duties around accuracy and permissible use.

Example: In June 2012, the FTC announced that data broker Spokeo would pay $800,000 to settle charges that it marketed profiles (compiled from sources including social media) to employers and recruiters without following FCRA requirements, such as ensuring the information was used only for permissible purposes and was accurate. It was the FTC’s first case about selling internet and social media data for employment screening.
Why it matters for OSINT: If your work is used to decide whether someone gets hired, rented to, or insured, the FCRA may apply. That’s why many people-search sites state that their data can’t be used for those purposes.

Voter Registration Data

Voter records are public in many states, but “public” often comes with use restrictions. For example, California Elections Code § 2194 allows voter registration information to be provided for election, scholarly, journalistic, political, or governmental purposes, and prohibits using it for personal, private, or commercial purposes, including harassment of any voter or their household. Rules vary widely by state, so check before using voter data in any investigation.

Breach Data and Leaked Credentials

The law around simply possessing leaked data is complicated and varies, but some lines are clear:

Using leaked credentials to log in to an account that isn’t yours is unauthorized access (CFAA and state laws).
Access device fraud (18 U.S.C. § 1029): It’s a federal crime to knowingly, and with intent to defraud, possess fifteen or more counterfeit or unauthorized access devices. “Access device” includes cards, codes, account numbers, and other means of account access, and “unauthorized” includes lost or stolen ones. Intent to defraud is a key element, but this is one reason organizations are careful about storing stolen credentials.
Some leaked material carries special risks: stolen financial data, classified information, and any illegal content (which you must never download or view).

Practical rule for this class: checking whether an email appears in a breach is fine; downloading, storing, or using the breach data is not. See 2.4-ethics-and-harm.md for the ethics side.

Stalking, Harassment, and Doxxing Laws

Federal stalking law — 18 U.S.C. § 2261A

This statute covers people who, with intent to kill, injure, harass, or intimidate someone (or place them under surveillance with that intent), use the mail, an interactive computer service, an electronic communication service, or another facility of interstate commerce to engage in a course of conduct (a pattern of two or more acts) that:

places the person in reasonable fear of death or serious bodily injury (to themselves or certain people close to them), or
causes, attempts to cause, or would reasonably be expected to cause substantial emotional distress.

OSINT techniques (tracking someone’s location through their posts, mapping their routine, contacting their associates) can become evidence of stalking when combined with that intent.

State doxxing laws

“Doxxing” means publishing someone’s personal identifying information, typically to enable harassment or harm. A growing number of states have specific doxxing laws, and they differ a lot:

California: Penal Code § 653.2 makes it a misdemeanor to electronically distribute someone’s personal identifying information with intent to place them in reasonable fear for their safety or to cause others to harass them (up to one year in county jail and a fine of up to $1,000). California has also added a civil right of action for doxxing victims (verify the current civil statute before class).
Oregon: Its law covers disclosing someone’s personal information knowing they could be stalked, harassed, or injured, and lets victims sue (verify details before class).
Colorado: Has doxxing protections focused on certain public officials and employees.
Criminal vs. civil: Some states treat doxxing only as a crime, some only allow lawsuits, and some allow both.

Even in states without a specific doxxing law, harassment, stalking, and intimidation laws can apply.

Putting It Together: Where OSINT Work Can Cross the Line

Activity	Main legal risk
Reading public web pages and search results	Very low
Scraping public pages while logged out	Usually not a CFAA crime; possible contract or other civil claims
Scraping or collecting while logged in to an account	Terms of service (contract), possibly more
Creating fake accounts	Terms of service; hiQ lost partly because of this
Logging in with leaked or guessed credentials	Unauthorized access (CFAA, state law)
Bypassing a login, paywall, or IP block	Unauthorized access risk (“gates-up-or-down”)
Collecting personal data about people in the EU	GDPR obligations, even if public
Using compiled data to screen job applicants	FCRA
Using voter data for non-permitted purposes	State election law
Storing large volumes of stolen credentials	Access device fraud risk, data protection risk
Publishing someone’s personal info to intimidate them	Doxxing, stalking, harassment laws

Key Terms

CFAA: The Computer Fraud and Abuse Act (18 U.S.C. § 1030), the main US federal computer crime law.
Without authorization / exceeds authorized access: The two CFAA access clauses, covering outsiders with no permission and insiders who go beyond their permission.
Gates-up-or-down: The Van Buren test asking whether you were allowed into a system or a particular area of it, regardless of your purpose.
Breach of contract: Violating an agreement, such as a website’s terms of service, which can lead to civil liability.
Personal data (GDPR): Any information relating to an identified or identifiable person.
Special category data: GDPR’s list of sensitive data types (health, religion, sexual orientation, biometrics, etc.) with stricter rules.
Publicly available information (CCPA/CPRA): Information excluded from California’s definition of personal information, such as government records and information the consumer made public.
Consumer reporting agency (FCRA): A company that assembles information about people for eligibility decisions like employment or housing.
Access device: Under 18 U.S.C. § 1029, a card, code, account number, or other means of account access.
Doxxing: Publishing someone’s personal identifying information, usually to enable harassment or harm.
Course of conduct: Under the federal stalking statute, a pattern of two or more acts showing continuity of purpose.

Key Takeaways

Legal risk depends on how you got the information, what it is, and what you do with it.
Van Buren (2021): the CFAA is about getting through gates you weren’t given, not about your motive.
hiQ v. LinkedIn: scraping public data likely wasn’t a CFAA crime, but fake accounts and terms violations still cost hiQ $500,000 and its data.
The DOJ’s 2022 policy protects good-faith security research from federal charges, but not from lawsuits or state laws.
Under the GDPR, public personal data is still personal data.
Using leaked credentials is unauthorized access. Checking for exposure is not the same as downloading the data.
Compiling public information to harass or intimidate someone can be stalking or doxxing.
This is not legal advice: laws vary by state and country, so ask a lawyer before real engagements.

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.