But it always has - if a given user improperly gains access to an American computer system, they violate federal law, specifically the Computer Fraud and Abuse Act (CFAA) of 1986. By making these activities federal crimes, the CFAA creates a legal foundation for pursuing alleged infringers, regardless of their location.
In deciding whether a U.S. statute may be applied extraterritorially, courts look to two potential foundations for jurisdiction: first, the jurisdictional basis, “territoriality, nationality, passive personality, universality, or the protective principle”; and second, legislative intent. CFAA Passes both these tests. This is clarified in U.S. Const. art. I, § 8s. 10, 3; art. VI, cl. 2. Cf. United States v. Baston, 818 F.3d 651, 666-67 (11th Cir. 2016) (“Congress’s power to enact extraterritorial laws is not limited to the Offenses Clause”).
If you want a phrase that does a lot of heavy lifting, the specific computers in scope are defined under section 18 U.S.C. § 1030(e)(2) - "...including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States."
Similarly, in United States v. Neil Scott Kramer (2011) it was determined that ALL cell-phones represent computers in scope - "...the United States Court of Appeals for the Eighth Circuit found that a cell phone can be considered a computer if "the phone perform[s] arithmetic, logical, and storage functions."
My favourite, however, is the precedent set by Pulte Homes, Inc. v. Laborers' International Union (2011) - urging legitimate communications via official digital channels constitutes a DDOS and breach of the CFAA if the official channel cannot handle the subsequent spike in volume!
This travesty arose after Pulte fired an employee represented by the union and LIUNA urged members to call and send email to the company to express their dissatisfaction. As a result of the increased traffic, the company's email system crashed. The Sixth Circuit ruled that the LIUNA's instruction to call and email "intentionally caused damage".
My point wasn't whether a state can claim jurisdiction or whether they might even win in their local court.
They need to be able to actually try the case. For a foreigner charged with a crime they would need to be caught on US soil or extradited by a country willing to cooperate. For businesses it generally comes down to leverage the government may have on corporate assets or similarly arresting business leaders should they be caught on US soil (or whatever country is indicting them).
Governments can claim jurisdiction, they can't always enforce it and other countries don't always agree on that jurisdictional claim.
In deciding whether a U.S. statute may be applied extraterritorially, courts look to two potential foundations for jurisdiction: first, the jurisdictional basis, “territoriality, nationality, passive personality, universality, or the protective principle”; and second, legislative intent. CFAA Passes both these tests. This is clarified in U.S. Const. art. I, § 8s. 10, 3; art. VI, cl. 2. Cf. United States v. Baston, 818 F.3d 651, 666-67 (11th Cir. 2016) (“Congress’s power to enact extraterritorial laws is not limited to the Offenses Clause”).
i.e. the Chinese Military Personnel Charged with Computer Fraud, Economic Espionage and Wire Fraud for Hacking into Credit Reporting Agency Equifax, https://www.justice.gov/opa/pr/chinese-military-personnel-ch...
If you want a phrase that does a lot of heavy lifting, the specific computers in scope are defined under section 18 U.S.C. § 1030(e)(2) - "...including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States."
Similarly, in United States v. Neil Scott Kramer (2011) it was determined that ALL cell-phones represent computers in scope - "...the United States Court of Appeals for the Eighth Circuit found that a cell phone can be considered a computer if "the phone perform[s] arithmetic, logical, and storage functions."
My favourite, however, is the precedent set by Pulte Homes, Inc. v. Laborers' International Union (2011) - urging legitimate communications via official digital channels constitutes a DDOS and breach of the CFAA if the official channel cannot handle the subsequent spike in volume!
This travesty arose after Pulte fired an employee represented by the union and LIUNA urged members to call and send email to the company to express their dissatisfaction. As a result of the increased traffic, the company's email system crashed. The Sixth Circuit ruled that the LIUNA's instruction to call and email "intentionally caused damage".