I'm deeply interested in these issues as well - the criminal aspect of the CFAA being disconnected from actual harm caused to people is insane to me. There doe

I'm deeply interested in these issues as well - the criminal aspect of the CFAA being disconnected from actual harm caused to people is insane to me. There does seem to be momentum towards a narrow reading of the CFAA when it comes to providing false information against terms of service, though, as per these 2013 analyses... though they fall short of actually giving any guarantees. https://www.whiteandwilliams.com/media/alert/247_Coverage%20Inkwell%2010.11.13.pdf https://www.whiteandwilliams.com/media/alert/247_Coverage%20... http://tsi.brooklaw.edu/cases/matot-v-ch http://tsi.brooklaw.edu/cases/matot-v-ch On the other hand, a denial of a motion to dismiss in Ticketmaster v. Prestige from 2018 seems to have drawn a distinction between breaching terms of service alone, and being told in a cease-and-desist not to breach those terms; the latter more clearly outlines what would be considered exceeding authorized levels of access. https://casetext.com/case/ticketmaster-llc-v-prestige-entmt-w-inc https://casetext.com/case/ticketmaster-llc-v-prestige-entmt-... Where does false information end and privilege escalation begin? Can that question depend on whether your privilege escalation is something as simple as "I'm now able to avoid the fine-print contract that I need to watch certain types and customizations of ads in order to access the service?" What constitutes sufficient notice to a user that certain actions are explicitly forbidden, if a C&D does but terms of service do not? All questions that, as far as I can tell, haven't been fully answered. (Obligatory: Not a lawyer, the above is not legal advice.)