On May 19, 2022 the U.S. Department of Justice revised its charging policy for the Computer Fraud and Abuse Act so that prosecutors will not charge good faith security research as a violation. It is a prosecutorial policy, not a change in the statute, and it does not bind civil plaintiffs or state authorities. This is education, not legal advice.
What the policy says
According to a Morrison Foerster summary, the policy defines good faith security research as accessing a computer solely to test, investigate or correct a security flaw, carried out to avoid harm to individuals or the public, with results used primarily to promote security or safety. The summary says bug bounty and white hat work is likely to qualify, while using discovered flaws for extortion would not.
The policy also tells prosecutors not to bring "exceeds authorized access" charges for conduct such as breaching a website's terms of service or an employer's computer use policy, per the same summary. Prosecutors still must show the person knowingly accessed an area of a computer they were not allowed to enter.
What it does not do
Three limits are worth stating plainly.
It is a charging policy. It guides federal prosecutors and does not create a legal right or defence.
It does not cover civil claims. A company can still sue.
It does not govern state law, other countries' law, or contract terms. A researcher could still face a terms of service dispute or a foreign legal claim.
Because the summary notes the policy does not itself define the statute's terms, grey areas remain.
Why engineering leaders should care
You are on both sides of this.
As a recipient of reports, you can make your policy clear. A published disclosure policy that states what testing is welcome and promises not to pursue good faith researchers reduces fear and noise. See what safe harbor means in a disclosure policy and our checklist.
As a producer of research, perhaps your own red team or a contractor, you want written scope and authorisation. The DOJ policy is not a substitute for permission.
A short checklist for internal testers
- Get written scope and approval from the system owner.
- Limit access to what the test needs.
- Stop and report if you reach personal data you did not expect.
- Do not retain or share what you find beyond the report.
- Never connect findings to a demand for payment.
Do not rely on it alone
Commentators noted it is unclear how much the policy changes practice. For a security team, the safe reading is that it lowers one risk, federal criminal charges for sincere research, and leaves others in place. Written authorisation, a clear scope and a counsel contact remain the working protection.
Quick check
Does the policy make security research legal?
No. It says federal prosecutors should decline to charge good faith research under the CFAA. It does not change the statute, civil liability or state law.
Does it protect testing without permission?
Not reliably. The definition turns on good faith and avoiding harm. Written authorisation is the safer route.
Sources
Last reviewed: 19 October 2026.
