The CFAA may have been written with malicious computer break-ins in mind, but in reality it’s used to target an incredibly broad range of activities completely divorced from “hacking,” and Aaron Swartz is only the most recent example. Framed during a time of widespread computer illiteracy when nefarious depictions of hackers dominated mainstream media, the law attempted to bring order to the new computational “Wild West” by combating unauthorized access to protected systems in government and finance. But today, the CFAA can effectively mark anyone who uses a computer to access another computer (e.g., anyone on the internet) as a felon.

The hook in Swartz's case had to do with something we should all be familiar with: Terms of Service. Whether we’re using Gmail or Facebook or logging on to a company-owned server at work, these contracts have us agree to certain rules as a condition of accessing a computer or service. If we break any of these rules, the company has the right to suspend access, terminate employment, or sue in court, if the resulting damage is significant.

All of that would be just fine if it weren’t for a section of the CFAA describing “unauthorized” and “excessive” access of a “protected computer” — or to be more accurate, not describing it. This section is supposed to define the terms which constitute a criminal intrusion, but the language is so plain that the law basically leaves this up to the imaginations of the courts.

The result is that the courts actually default to the language in those Terms of Service, network use policies, and other private contracts, as defined by the employers and web services in question. To wit, the CFAA can make breaking a code of conduct or violating a social network’s Terms of Service into a felony, which in effect gives private companies the ability to set the definitions of criminality wherever a computer is involved.

That’s not because of any recent changes in the law’s text, however — it’s due to aggressive federal prosecutors taking advantage of the CFAA’s malleable nature to crack down on a wide variety of computer-related activities — including, conveniently enough, the kind that embarrass or undermine the authority of the federal government and their corporate sponsors.

The government has sent a similar message when prosecuting another form of “non-hack”: the Distributed Denial of Service (DDoS) attack. Made popular by members of leaderless hacktivist collective Anonymous, DDoS attacks have been blamed for causing extensive damage to corporate computer systems. Mercedes Haefer, a 21 year old journalism student, participated in one such attack as part of “Operation Payback,” the campaign against PayPal in response to its refusal to process donations for Wikileaks.

The goal of a DDoS attack isn't to cause lasting damage — it's to temporarily slow or block access to certain websites by sending a flood of requests, an act some have compared to civil disobedience. But the punishments being doled out for digital disruptions vastly overshadow the night in jail plus fine given to many of the 700 Occupy Wall Street protestors who shut down the Brooklyn bridge in October of 2011: Haefer and 13 other Anonymous members are now each facing up to 15 years in prison and $500,000 in fines.

Which highlights another area where the law is stacked against actors in the digital space: proportionality.

In Swartz’s case, US Attorney Carmen Ortiz contended that "Stealing is stealing whether you use a computer command or a crowbar." But even if you ignore the nature of the content in question (publicly-funded research, able to be duplicated infinitely), it has little basis in what the law prescribes for a similar situation in physical reality. Under Massachusetts state law, someone going into a library and stealing a large quantity of physical books would be charged with trespassing, which carries a maximum punishment of 30 days in jail or a $100 fine. If the value is more the $250, the maximum sentence is 2 - 5 years — leagues below what Swartz faced for his 13 felony counts under the CFAA.

“We agree there should be reasonable computer crime laws, but it seems that all the prosecutions we hear about aren't reasonable,” says Hanni Fakhoury, a Senior Staff Attorney for the Electronic Frontier Foundation. He notes that some courts, notably those in the Fourth and Ninth Circuits, have recently pushed back against broad interpretations of the CFAA which use Terms of Service violations to push criminal charges. But in others, he says, prosecutors continue to test the limits of the law.

In August of 2011, members of various groups from across the political spectrum including the EFF, the ACLU, and the Heritage Foundation had exactly the same idea. In a letter to Senators Patrick Leahy and Chuck Grassley, they wrote that activities which violate terms of service “should not be “computer crimes,” any more than they are crimes in the physical world.”

If, for example, an employee photocopies an employer’s document to give to a friend without that employer’s permission, there is no federal crime (though there may be, for example, a contractual violation). However, if an employee emails that document, there may be a CFAA violation. If a person assumes a fictitious identity at a party, there is no federal crime. Yet if they assume that same identity on a social network that prohibits pseudonyms, there may again be a CFAA violation. This is a gross misuse of the law.

The CFAA should focus on malicious hacking and identity theft and not on criminalizing any behavior that happens to take place online in violation of terms of service or an acceptable use policy.”

Fakhoury agrees it’s a good time call for CFAA reform, but worries whether the efforts can attract enough support in Congress. He points to a previous attempt by Sen. Patrick Leahy to fix the TOS loophole, which wound up being tied to even higher sentences and the addition of a two-year mandatory minimum.

Since its announcement, copyright reform advocate Lawrence Lessig, Swartz’s former mentor, has thrown his enthusiastic support behind Lofgren’s proposed bill, and others have left feedback and suggestions on ways to refine it.

As for the debate over prosecutorial overreach, Lofgren acknowledges it’s a broader issue that needs attention. But for now, she’s intent on honing in on the more immediate problem, and hopeful that she can gather bipartisan support.

“What I want to do first is address the [CFAA] statute that was used in a way that I think shocked a lot of people,” she says. “Most people, when they look at what Aaron did, think it shouldn't be a crime at all, certainly not a felony and certainly not [carrying] mandatory minimums."