CFAA after Van Buren
The 1986 Computer Fraud and Abuse Act criminalizes accessing a computer "without authorization" or in a way that "exceeds authorized access." For decades the second clause was interpreted broadly enough to cover violating a terms-of-service. The Aaron Swartz case (2011, downloading academic papers from JSTOR) and many lesser ones happened under that reading.
Van Buren v United States (2021) narrowed it. A police officer used legitimate database access for a personal purpose. The Supreme Court held that "exceeds authorized access" applies only when the actor accesses areas they were not authorized to enter, not when they misuse data they were authorized to access. The decision shrunk CFAA's reach over misuse cases but did not touch the unauthorized-access prong.
Practical effect for security research: violating a website's ToS is no longer automatically a federal crime under CFAA. The "access without authorization" core stays intact: probing systems you have no relationship with is still chargeable.
Computer Misuse Act (UK)
The CMA 1990 has three core offences: unauthorized access (s.1), unauthorized access with intent to commit further offences (s.2), and unauthorized modification (s.3). A 2015 amendment added s.3ZA for attacks causing serious damage.
The UK has no statutory safe harbor for security research. The CyberUp campaign has been advocating for one since 2019 with no movement to date. Researchers operating in the UK rely on careful written authorization, bug bounty safe-harbor language, and the prosecutor's discretion. Many UK researchers route through US-hosted bounty platforms specifically because of this gap.
GDPR's 72-hour rule
Article 33 of GDPR requires data controllers to notify their supervisory authority within 72 hours of becoming aware of a personal-data breach, unless the breach is unlikely to result in risk to data subjects. If risk is high, Article 34 requires notifying affected individuals "without undue delay."
What counts as "aware": from the moment the controller has reasonable certainty a breach occurred, not from the moment investigation completes. Late notification routinely draws regulator attention; under-reporting draws more.
What counts as a breach: confidentiality (unauthorized access), integrity (unauthorized alteration), or availability (loss of access, which includes ransomware). The third surprises many IT teams.
Coordinated disclosure standards
Two industry standards worth knowing by name:
- ISO/IEC 29147: vulnerability disclosure. Defines roles (finder, vendor, coordinator), timelines, communication patterns.
- ISO/IEC 30111: vulnerability handling processes inside vendors. The counterpart on the recipient side.
CERT/CC and many national CSIRTs publish their own frameworks. The recurring norm: report privately, give a reasonable window (90 days is the modern default popularized by Google Project Zero), coordinate publication.
Safe harbor in a bug bounty program
Good safe-harbor language explicitly:
- Authorizes specific testing techniques against specific targets, in writing.
- Promises not to pursue legal action for good-faith research within scope.
- Names disallowed activities (DoS, social engineering of employees, data exfiltration beyond proof-of-concept).
- References DMCA Section 1201 protections in the US for testing software locks.
- Provides a clear contact for clarifying scope before testing.
Read it before testing. The Disclose.io safe-harbor template is the modern reference and what most reputable programs base on.