The policy does not address all of the CFAA’s complaints, such as the possibility of excessively long jail sentences. It has no effect on the underlying statute, as it simply impacts how prosecutors read it. The Department of Justice further emphasizes that the security research exception is not a “free pass” to probe networks. Someone who discovered a problem and used that information to extort the system’s owner, for example, could be punished by conducting research in bad faith. Despite these restrictions, the rulemaking is a promise not to lay harsh anti-hacking penalties on anyone who uses a computer system in a way that its owner does not approve of.
