Computer Fraud and Abuse Act (CFAA)
The 1986 US federal anti-hacking law, written for a world of mainframes and still used against everything from worms to downloaded journal articles.
The act criminalises accessing a computer "without authorization" or in a way that "exceeds authorized access" — phrases it never properly defined. Its first conviction was Robert Tappan Morris in 1990, after the Morris worm.
The vagueness became a political problem in 2012, when prosecutors brought thirteen counts against Aaron Swartz for bulk-downloading JSTOR articles over MIT's network. After his death in 2013, "Aaron's Law" was introduced to narrow the statute; it never passed. Andrew Auernheimer's conviction for scraping publicly exposed AT&T email addresses also rested on the CFAA. Only in 2021, in Van Buren v. United States, did the Supreme Court rein in what "exceeds authorized access" means.