The CFAA is what's used against cases for hacking. They engaged with a system for which they didn't have permission to operate against. > (2) intentionally acc

The CFAA is what's used against cases for hacking. They engaged with a system for which they didn't have permission to operate against. > (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— > (C) information from any protected computer; and if you want to argue extortion like other comments here, > (7) with intent to extort from any person any money or other thing of value, transmits in interstate or foreign commerce any communication containing any— > (B) threat to obtain information from a protected computer without authorization or in excess of authorization or to impair the confidentiality of information obtained from a protected computer without authorization or by exceeding authorized access; or https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act -- UNLESS an entity has a program for this (by which they give permission) or you have an engagement to engage with their system (and this system), you NEVER engage. Ask anyone in security.