PUBLIC LAW 99-474—OCT. 16, 1986 100 STAT. 1213
Public Law 99-474
99th Congress
An Act
To amend title 18, United States Code, to provide additional penalties for fraud and n t Ifi 198fi
related activities in connection with access devices and computers, and for other '
purposes. fH.R. 4718]
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled. Computer Fraud and Abuse Act
SECTION 1. SHORT TITLE. of 1986.
This Act may be cited as the "Computer Fraud and Abuse Act of note
1986".
SEC. 2. SECTION 1030 AMENDMENTS.
(a) MODIFICATION OF DEFINITION OF FINANCIAL INSTITUTION.—Sec
tion 1030(aX2) of title 18, United States Code, is amended—
(1) by striking out "knowingly" and inserting "intentionally"
in lieu thereof;
(2) by striking out "as such terms are defined in the Right to
Financial Privacy Act of 1978 (12 U.S.C. 3401 et seq.),";
(3) by striking out the term "or" where it appears at the end
of section 1030(aX2) of title 18; and
(4) by adding after the term "financial institution" the follow
ing: "or of a card issuer as defined in section 1602(n) of title 15,".
(b) MODIFICATION OF EXISTING GOVERNMENT COMPUTERS OF
FENSE.—Section 1030(aX3) of title 18, United States Code, is
amended—
(1) to read as follows:
"(3) intentionally, without authorization to access any com
puter of a department or agency of the United States, accesses
such a computer of that department or agency that is exclu
sively for the use of the Government of the United States or, in
the case of a computer not exclusively for such use, is used by or
for the Government of the United States and such conduct
affects the use of the Government's operation of such
computer;"; and
(2) by striking out the flush language after section 1030(aX3)
of title 18, United States Code, beginning with "It is not an
offense" and all that follows through "use of the computer.".
(c) MODIFICATION OF AUTHORIZED ACCESS ASPECT OF OFFENSES.—
Paragraphs (1) and (2) of section 1030(a) of title 18, United States
Code, are each amended by striking out ", or having accessed" and
all that follows through "does not extend" and inserting "or exceeds
authorized access" in lieu thereof,
(d) NEW OFFENSES.—Section 1030(a) of title 18, United States Ckxie,
is amended by inserting after paragraph (3) the following:
"(4) knowingly and with intent to defraud, accesses a Federal
interest computer without authorization, or exceeds authorized
access, and by means of such conduct furthers the intended
fraud and obtains anything of value, unless the object of the 100 STAT. 1214 PUBLIC LAW 99-474—OCT. 16, 1986
fraud and the thing obtained consists only of the use of the
computer;
"(5) intentionally accesses a Federal interest computer with
out authorization, and by means of one or more instances of
such conduct alters, damages, or destroys information in any
such Federal interest computer, or prevents authorized use of
any such computer or information, and thereby—
"(A) causes loss to one or more others of a value aggregat
ing $1,000 or more during any one year period; or
"(B) modifies or impairs, or potentially modifies or im
pairs, the medical examination, medical diagnosis, medical
treatment, or medical care of one or more individuals; or
"(6) knowingly and with intent to defraud traffics (as defined
18 use 1029. in section 1029) in any password or similar information through
which a computer may be accessed without authorization, if—
Commerce and "(A) such trafficking affects interstate or foreign com-
trade. merce; or
"(B) such computer is used by or for the Government of
the United States;".
(e) EuMiNATiON OF SECTION SPECIFIC CONSPIRACY OFFENSE.—Sec
tion 1030(b) of title 18, United States (Dode, is amended—
(1) by striking out "(1)"; and
(2) by striking out pareigraph (2).
(f) PENALTY AMENDMENTS.—Section 1030 of title 18, United States
Code, is amended—
(1) by striking out "of not more than the greater of $10,000"
and all that follows through "obtained by the offense" in subsec
tion (cXlXA) and inserting "under this title" in lieu thereof;
(2) by striking out "of not more than the greater of $100,000"
and all that follows through "obtained by the offense" in subsec
tion (cXlXB) and inserting "under this title" in lieu thereof;
(3) by striking out "or (aX3)" each place it appears in subsec
tion (cX2) and inserting ", (aX3) or (aX6)" in lieu thereof;
(4) by striking out "of not more than the greater of $5,000"
and all that follows through "created by the offense" in subsec
tion (cX2XA) and inserting "under this title" in lieu thereof;
(5) by striking out "of not more than the greater of $10,000"
and all that follows through "created by the offense" in subsec
tion (cX2XB) and inserting "under this title" in lieu thereof;
(6) by striking out "not than" in subsection (cX2XB) and
inserting "not more than" in lieu thereof;
(7) by striking out the period at the end of subsection (cX2XB)
and inserting "; and" in lieu thereof; and
(8) by adding at the end of subsection (c) the following:
"(3XA) a fine under this title or imprisonment for not more
than five years, or both, in the case of an offense under subsec
tion (aX4) or (aX5) of this section which does not occur after a
conviction for another offense under such subsection, or an
attempt to commit an offense punishable under this subpara
graph; and
"(B) a fine under this title or imprisonment for not more than
ten years, or both, in the case of an offense under subsection
(aX4) or (aX5) of this section which occurs after a conviction for
another offense under such subsection, or an attempt to commit
an offense punishable under this subparagraph."; and PUBLIC LAW 99-474—OCT. 16, 1986 100 STAT. 1215
(9) by deleting the term "(bXD" where it appears in the first
line of section 1030(c) of title 18 and inserting in lieu thereof the
term 'W.
(g) CONFORMING AMENDMENTS TO DEFINITIONS PROVISION.—Sec
tion 1030(e) of title 18, United States Code, is amended—
(1) by striking out the comma after "As used in this section"
and inserting a one-em dash in lieu thereof;
(2) by aligning the remaining portion of the subsection so that
it is cut in two ems and begins as an indented paragraph, and
inserting "(1)" before "the term";
(3) by striking out the period at the end and inserting a
semicolon in lieu thereof; and
(4) by adding at the end thereof the following:
"(2) the term 'Federal interest computer' means a computer—
"(A) exclusively for the use of a financial institution or
the United States Government, or, in the case of a com
puter not exclusively for such use, used by or for a financial
institution or the United States Government and the con
duct constituting the offense affects the use of the financial
institution's operation or the Government's operation of
such computer; or
"(B) which is one of two or more computers used in
committing the offense, not all of which are located in the
same State;
"(3) the term 'State' includes the District of Columbia, the
Commonwealth of Puerto Rico, and any other possession or
territory of the United States;
"(4) the term 'financial institution' mesms—
"(A) a bank with deposits insured by the Federal Deposit
Insurance Corporation;
"(B) the Federal Reserve or a member of the Federal
Reserve including any Federal Reserve Bank;
"(C) an institution with accounts insured by the Federal
Savings and Loan Insurance Corporation;
"(D) a credit union with accounts insured by the National
Credit Union Administration;
"(E) a member of the Federal home loan bank system and
any home loan bank;
'(F) any institution of the Farm Credit System under the
Farm Credit Act of 1971; 12 USC 2001
"(G) a broker-dealer registered with the Securities and note.
Exchange C!ommission pursuant to section 15 of the Securi
ties Exchange Act of 1934; and 15 USC 78o.
"(H) the Securities Investor Protection C!orporation;
"(5) the term 'financial record' means information derived
from any record held by a financial institution pertaining to a
customer's relationship with the financial institution;
"(6) the term 'exceeds authorized access' means to access a
computer with authorization and to use such access to obtain or
alter information in the computer that the accesser is not
entitled so to obtain or alter; and
"(7) the term 'department of the United States' means the
legislative or judicial branch of the Government or one of the
executive departments enumerated in section 101 of title 5.".
(h) LAW ENFORCEMENT AND INTELUGENCE ACTIVITY ExcEPTiON.—
Section 1030 of title 18, United States CJode, is amended by adding at
the end the following new subsection: 100 STAT. 1216 PUBLIC LAW 99-474—OCT. 16,1986
Law "(f) This section does not prohibit any lawfully authorized inves-
enforcement and tigative, protective, or intelligence activity of a law enforcement
crime. agency of the United States, a State, or a political subdivision of a
State and local gt^te, or of an intelligence agency of the United States.",
governments. = ^
Approved October 16, 1986.
LEGISLATIVE HISTORY—H.R. 4718 (S. 2281):
HOUSE REPORTS: No. 99-612 (Comm. on the Judiciary).
SENATE REPORTS: No. 99-432 accompanying S. 2281 (Comm. on the Judiciary).
CONGRESSIONAL RECORD, Vol. 132 (1986):
June 3, considered and passed House.
Oct. 1, S. 2281 considered and passed Senate.
Oct. 3, H.R. 4718 considered and passed Senate, amended.
Oct. 6, House concurred in Senate amendments.
Brief
The Computer Fraud and Abuse Act of 1986 was enacted on October 16, 1986. The law provides additional penalties for fraud and related activities in connection with access devices and computers. It amends title 18 of the United States Code to include new offenses and increase penalties for existing ones. The law defines a "Federal interest computer" and increases penalties for unauthorized access or exceeding authorized access. It also adds an exception for lawfully authorized investigative, protective, or intelligence activity.
Highlights content goes here...
Purpose
The purpose of Public Law 99-474, also known as the Computer Fraud and Abuse Act (CFAA), is to amend title 18, United States Code, by providing additional penalties for fraud and related activities in connection with access devices and computers. The law aims to prevent unauthorized access to computer systems, including those used by financial institutions, government agencies, and other organizations.
Key Provisions
The CFAA introduces several key provisions aimed at combating computer-related crimes:
- Definition of Financial Institution: The law expands the definition of a “financial institution” to include card issuers as defined in section 1602(n) of title 15.
- Modification of Existing Government Computers Offense: The amendment modifies the existing offense related to accessing government computers without authorization, making it more specific and adding language to clarify that the offense affects the use of the government’s operation of such computer.
- New Offenses: The CFAA introduces three new offenses:
- Accessing a Federal interest computer without authorization, with intent to defraud, and obtaining anything of value (§1030(a)(4)).
- Intentionally accessing a Federal interest computer without authorization, altering, damaging, or destroying information, preventing authorized use, causing loss aggregating $1,000 or more during any one year period, or impairing medical treatment or care (§1030(a)(5)).
- Trafficking in passwords or similar information to access computers without authorization, affecting interstate or foreign commerce (§1030(a)(6)).
- Penalty Amendments: The law amends penalties for CFAA offenses, including increasing fines and imprisonment terms.
- Conforming Amendments to Definitions Provision: The CFAA clarifies the definition of “Federal interest computer” and introduces new definitions for “financial institution,” “financial record,” “exceeds authorized access,” and “department of the United States.”
- Law Enforcement and Intelligence Activity Exception: The law excludes lawfully authorized investigative, protective, or intelligence activities from the provisions of the CFAA.
Industry Impact
The Computer Fraud and Abuse Act has significant implications for various industries:
- Financial Institutions: The expanded definition of a “financial institution” affects financial institutions’ ability to protect sensitive customer information.
- Government Agencies: The law’s modifications and new offenses impact government agencies’ computer security practices and policies.
- Private Sector Organizations: The CFAA’s penalties and enforcement provisions influence private sector organizations’ cybersecurity measures and incident response strategies.
Updates/Amendments
The Computer Fraud and Abuse Act has undergone several updates and amendments since its initial passage:
- Public Law 99-474 (1986): Introduced the CFAA, providing additional penalties for computer-related crimes.
- Further Amendments: Subsequent amendments have refined definitions, increased penalties, and clarified exceptions.
Note that while this summary provides an overview of the key provisions, industry impact, and updates/amendments related to the Computer Fraud and Abuse Act, it is essential to consult the actual law or relevant authorities for precise information on these topics.