Digital Boundaries in Cybercrime Law: Authorisation, Venue and Extraterritorial Jurisdiction under the Computer Fraud and Abuse Act

Abstract

Cybercrime exposes a recurring mismatch between networked conduct and legal rules built around bounded permissions and territorial places. This article develops a two-axis “digital boundaries” framework through a doctrinal comparison of four United States cases: Van Buren v United States, United States v Nosal, United States v Auernheimer, and United States v Ivanov. The first axis concerns the boundary of computer authorisation: whether criminal liability turns on an improper purpose, on access to information technically or legally unavailable to the user, or on access after permission has been affirmatively revoked. The second axis concerns territorial allocation: where a cyber offence may be prosecuted when actors, servers, data, victims and harmful effects are distributed across multiple places. The cases show that broad substantive reach cannot substitute for a constitutionally and procedurally valid venue, while a narrow approach to “exceeds authorised access” does not eliminate liability where access has actually been revoked. The article argues that cybercrime law should separate four questions that are often collapsed: system permission, information entitlement, purpose of use, and territorial nexus. It proposes a structured decision model for courts and investigators and identifies complementary organisational controls and cross-border cooperation mechanisms. The resulting framework aims to improve legal certainty without treating every misuse of data as hacking or every downstream effect as sufficient to locate a prosecution. Case-level figures drawn from the decisions and descriptive data from FBI Internet Crime Complaint Center reports are used to illustrate the framework and the scale of the problem; the argument itself remains doctrinal.