After the 9th Circuit’s en banc ruling in United States v. Nosal (Nosal I), it appeared for a brief and shining moment that some clarity was being brought to the Computer Fraud and Abuse Act, that the court held that violating the terms of service did not elevate whatever private crap a website owner used into the foundation for a federal offense. But as so often happens, the clouds rolled in and obscured the sunlight.
“[W]ithout authorization” is an unambiguous, non-technical term that, given its plain and ordinary meaning, means accessing a protected computer without permission. This definition has a simple corollary: once authorization to access a computer has been affirmatively revoked, the user cannot sidestep the statute by going through the back door and accessing the computer through a third party. (Emphasis added.)
For an unambiguous, non-technical term, “without authorization” has caused the murder of a great many words in explanation. But there is some foreshadowing in there, perhaps not clearly noticed in Nosal II, but apparent now that the 9th Circuit has issued its decision in Facebook v. Power Ventures, which held that while no CFAA violation occurs based upon a violation of the terms of service per se, failure to abide by a cease and desist demand by the website owner based upon the violation gives rise to a violation of the CFAA.
In other words, violating TOS doesn’t make it a crime, but accessing a website after the owner has demanded you cease and desist does. Remember, “affirmatively revoked”? Continue reading


