Some Thoughts on the Computer Fraud and Abuse Act

The death of Aaron Swartz last week has drawn renewed attention to the Computer Fraud and Abuse Act (CFAA) (18 U.S.C. § 1030). If you’ve made it this far in the post, I will assume that you know what the CFAA is, and what it criminalizes.

My aim here isn’t to criticize or defend the CFAA generally, or the Swartz prosecution specifically. Instead, I simply want to offer up some data that fleshes out how, and how often, federal prosecutors have invoked the statute, from which others may draw their own conclusions.

As I explain to anyone who spends more than four minutes with me–which guarantees that very few persons do–I have complied a database of information on all federal prosecutions that terminated in federal district courts between October 2002 and September 2009 (FY 2003 — FY 2009).* The data come from the Administrative Office of the United States Courts (AOUSC), which compiles the information from terminated federal cases and makes it available to researchers through the Interuniversity Consortium for Political and Social Research. Though the data are far from perfect — humans input the information for each case, and humans make mistakes — they shed light on matters such as how often federal prosecutors invoke particular crimes, and what sorts of dispositions these cases produce.

Earlier this evening I ran a few searches on my database,** searching for prosecutions terminated between October 2002 and September 2009 that included at least one count alleged under 18 U.S.C. § 1030.*** (The database includes only the five “most serious” charges, so it doesn’t capture all counts in all cases, but it comes close.) Here’s what I found:

Total Number of § 1030 Cases. Altogether, 905 federal cases that terminated between October 2002 and September 2009 included at least one count under 18 U.S.C. § 1030 among the five “most serious” initial charges, or the five “most serious” charges at the time of case termination. (Note that here, the database identifies each defendant in a multi-defendant case as a separate “case.”)

Year-by-Year Breakdown. The number of filed cases that incorporated at least one 18 U.S.C. § 1030 charge, either at the time of case filing or case termination, increased a bit as the 2002–2009 timeframe progressed. The database contains 115 such cases that were filed in FY 2003; 98 cases filed in FY 2004; 131 cases filed in FY 2005, 143 cases filed in FY 2006, 145 cases filed in FY 2007, 129 filed in FY 2008, and 144 filed in FY 2009. Moreover, the actual number of § 1030 cases filed in FY 2008 and FY 2009 is certainly higher than the numbers above suggest. The database includes only terminated cases, and many cases filed during these fiscal years remained pending as of September 30, 2009, the last day of FY 2009.

Geographic Variation.  Prosecutors in the Central District of California filed the largest number of cases that included at least one § 1030 charge at case initiation or termination (82), followed by the Eastern District of California (48), Southern District of New York (37), the Eastern District of Virginia (also 37), and the Eastern District of Pennsylvania (35). Significantly, these were the only districts that averaged more than five § 1030 cases a year over the seven-year period. About half of all United States districts averaged one, or less than one, § 1030 case per year. The District of Massachusetts, where Swartz was prosecuted, saw sixteen (16) terminated section 1030 cases over the FY2003–FY2009 span.

Case Outcomes. Here, I focused on felony charges brought under 18 U.S.C. § 1030(a). Of the total of 893 counts under this subdivision with recorded dispositions over the studied period, 59 percent led to convictions. Section 1030(a) counts went to trial a bit more often than the “average” crime did. The trial rate of 6.7% for § 1030(a) charges was about half again the overall 4% trial rate for all charges in the dataset–but since only sixty § 1030(a) counts went to trial, it’s probably best not to draw any broad conclusions from this discrepancy. Tried § 1030(a) counts led to acquittals 18.3% of the time, meanwhile, a figure close to the dataset’s overall trial-acquittal rate of approximately 20%.

Sentencing Outcomes. On this point, I looked exclusively at the subset of 18 U.S.C. § 1030 cases in which the AOUSC identified § 1030 as the “most serious” charge at filing. Among these 767 cases, just south of 500**** led to no prison time for the defendant, either because of a dismissal, acquittal, or a sentence upon conviction that called for no custody time. The most commonly appearing prison sentences were pretty low; they were, in order, 12 months (the sentence in 34 cases), 5 months (25 cases), 18 months (also 25 cases), 15 months (14 cases), and 24 months (also 14 cases). But some cases — about 10 percent of all cases that led to a prison term (31 out of 279) — led to prison sentences of 57 months or more. Most of these big-sentence cases, however, also involved charges brought under statutes other than § 1030, as Swartz’s case did.

* * *

The data are open to a variety of interpretations. To get the ball rolling, here are a few thoughts of my own.

First, assuming the perpetuation of the trends discussed above, in most judicial districts there exist a handful of § 1030 prosecutions each year–at most. This fact means that (the applicable sentencing guideline notwithstanding) there exists no established “going rate” for plea bargains involving the offense. The lack of a “going rate” likely enhanced the uncertainty that Swartz internalized as his case progressed. Furthermore, because prosecutors don’t try very many § 1030 cases, they may have an incentive to allege a large number of counts in any given case, in order to enhance the somewhat opaque odds of conviction.

Second, I was somewhat surprised at the list of jurisdictions in which § 1030 prosecutions were most common. I would have thought that the Eastern District of New York  and the Northern District of California would have been among the leaders in CFAA prosecutions. And while these districts weren’t too far behind those listed above (the Northern District of California had 29 prosecutions containing a § 1030 count; the Eastern District of New York, 21), I wonder whether CFAA investigations weren’t prioritized in these districts, or whether U.S. Attorneys in these jurisdictions were, for some reason, relatively apathetic about prosecuting the crime.

Third, the 59 percent conviction rate for section 1030(a) charges is higher than the conviction rates for most of the other frequently alleged federal crimes, suggesting that these counts aren’t used as bargaining chips by federal prosecutors as often as many other crimes are.

* * *

* I’m working on getting some more recent data.

** Here, let me stress that I ran the data while also watching “Archer: Season  Two” on DVD. So please take the numbers presented here with a pinch of salt.

*** This search encompassed four “charge codes”: 18:1030A.F; 18:1030A.M, 18:1030B.F, and 18:1030B.M. The first of these charges was, by far, the most common.

**** There were a handful of AOUSC codes for custodial provisions that I didn’t take the time to decode. Suffice it to say that the number of non-prison outcomes may be as low as 467 and as high as 488, and is probably on the high end of this range.

Leave a Reply