Computer Crime and Researcher Lab
Practise advising on hacking and computer-misuse cases. Three fictional clients, three decisions courts and prosecutors have to make: what "exceeds authorised access" means, how good-faith research is treated in the US and the UK, and how a company should handle a participant who left a bounty programme's scope.
Each fact pattern is scored on seven decisions, with a seeded "how it played out" step, named classic mistakes, and a case memo and register you can download with Pro. The best answer is the defensible practice, because several of these questions are unsettled.
Not legal advice. Educational practice only, not legal advice. The people, companies, domains and facts are fictional. Rules differ by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer before relying on anything here.
Not legal advice. Educational practice only, not legal advice. The people, companies, domains and facts are fictional. Rules differ by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer before relying on anything here.
You are cyber and criminal-defence counsel at Ferrow & Quill LLP
Ferrow & Quill LLP is a fictional law firm advising people and companies on computer-misuse exposure. Three clients call: an employee who looked where he should not have, a researcher who went one step too far, and a company deciding what to do about a bug bounty participant who left the scope. You advise on authorisation, charging and defence judgement, and what to say to whom. All parties are fictional and the framing is defensive and educational. The rules named are real and were checked against the sources listed on the page.
- 1Issue spotting: What is the real authorisation question in this fact pattern?
- 2Statute and standard: Which statute and standard decide it?
- 3Strategy: What do you advise first?
- 4Scope and record: What record do you build or preserve?
- 5Facts that matter: Which facts matter to charging or defence? Tick every one that belongs.
- 6Communications: What is said, to whom, and through whom?
- 7Next step: What do you do next?
- 8See how it played out, from a seeded outcome
3 fact patterns. Pro keeps the rules in a fold-out and hides the hints. A good record choice uncovers hidden complications as you go. Passing score is 70%.
Loading…
TL;DRWhat this lab is
4 points
- A fictional-client practice lab for cyber and criminal-defence counsel: three fact patterns on authorisation, researcher good faith and bug bounty scope, with seeded outcomes.
- It is built from real sources (18 U.S.C. 1030, Van Buren, the DOJ charging policy, the UK Computer Misuse Act 1990 and CPS guidance) opened and checked on the date shown on the page.
- Educational and defensive only, with no operational hacking instructions. Not legal advice. Rules vary by jurisdiction and change.
- Pro lab: free to try with 3 Pro tool runs in total, shared across all Pro tools. Downloading the case memos and CSV register is Pro only.
Sources checked
Every rule named in this lab was checked against these pages on 2026-11-02. Law changes, so read the current text before you rely on any of it.
Two lookups and a shared password
- 18 U.S.C. § 1030, Fraud and related activity in connection with computers (Cornell LII reproduction of the U.S. Code) (reproduction of official text, checked 2026-11-02). § 1030(a)(2) "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains" information from a protected computer; (e)(6) definition of "exceeds authorized access"; (c)(2)(A) up to one year and (c)(2)(B) up to five years if commercial advantage or private gain, in furtherance of a criminal or tortious act, or value of information over $5,000; (e)(11) "loss"; (g) civil action for a person who suffers damage or loss, limited to the listed factors.
- Van Buren v. United States, No. 19-783 (U.S. June 3, 2021), opinion (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). An individual "exceeds authorized access" when he accesses a computer with authorization but obtains information in particular areas, such as files, folders or databases, that are off-limits to him; a gates-up-or-down inquiry; purpose-based misuse of access he had was not enough; footnote 8 leaves open whether the inquiry turns only on technological limits or also on limits in contracts or policies.
- U.S. Department of Justice, Justice Manual 9-48.000, Computer Fraud and Abuse Act (updated May 2022) (regulator, checked 2026-11-02). DOJ charging policy: "without authorization" requires no authorization by any person with authority to grant it and knowledge; "exceeding" requires an area divided in a computational sense, authorization to some areas but unconditional prohibition on others, and knowledge; prosecutors should decline when the evidence shows good-faith security research as defined; unambiguous written revocation; the policy creates no enforceable right.
- Computer Misuse Act 1990, section 1, Unauthorised access to computer material (legislation.gov.uk) (statute or regulation, checked 2026-11-02). Section 1(1): causes a computer to perform a function with intent to secure access to any program or data, access unauthorised, and knows that at the time; 1(3) penalties as revised (indictment: not exceeding two years).
- Computer Misuse Act 1990, section 17, Interpretation (legislation.gov.uk) (statute or regulation, checked 2026-11-02). Section 17(5): access is unauthorised if the person is not himself entitled to control access of the kind in question and does not have consent to access of that kind from a person who is; 17(8) the equivalent for acts under section 3.
- Crown Prosecution Service, Computer Misuse Act legal guidance (regulator, checked 2026-11-02). Prosecutors must prove knowledge that access was unauthorised (recklessness is not enough); describes Allison and Bignell on employees (the employer must clearly define the limits of authority); public-interest factors for charging (damage, financial gain, sophistication, victim vulnerability, defendant's mental health, maturity and age).
The researcher who went one step too far
- Computer Misuse Act 1990, section 1, Unauthorised access to computer material (legislation.gov.uk) (statute or regulation, checked 2026-11-02). Section 1(1): causes a computer to perform a function with intent to secure access to any program or data, access unauthorised, and knows that at the time; 1(3) penalties as revised (indictment: not exceeding two years).
- Computer Misuse Act 1990, section 3, Unauthorised acts with intent to impair, or with recklessness as to impairing, operation of computer, etc. (legislation.gov.uk) (statute or regulation, checked 2026-11-02). Section 3: unauthorised act, knowing it is unauthorised, with intent or recklessness as to impairing a computer, preventing or hindering access, or impairing programs or data; 3(6) indictment maximum ten years.
- Computer Misuse Act 1990, section 17, Interpretation (legislation.gov.uk) (statute or regulation, checked 2026-11-02). Section 17(5): access is unauthorised if the person is not himself entitled to control access of the kind in question and does not have consent to access of that kind from a person who is; 17(8) the equivalent for acts under section 3.
- Crown Prosecution Service, Computer Misuse Act legal guidance (regulator, checked 2026-11-02). Prosecutors must prove knowledge that access was unauthorised (recklessness is not enough); describes Allison and Bignell on employees (the employer must clearly define the limits of authority); public-interest factors for charging (damage, financial gain, sophistication, victim vulnerability, defendant's mental health, maturity and age).
The bounty hunter who left the scope
- 18 U.S.C. § 1030, Fraud and related activity in connection with computers (Cornell LII reproduction of the U.S. Code) (reproduction of official text, checked 2026-11-02). § 1030(a)(2) "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains" information from a protected computer; (e)(6) definition of "exceeds authorized access"; (c)(2)(A) up to one year and (c)(2)(B) up to five years if commercial advantage or private gain, in furtherance of a criminal or tortious act, or value of information over $5,000; (e)(11) "loss"; (g) civil action for a person who suffers damage or loss, limited to the listed factors.
- Van Buren v. United States, No. 19-783 (U.S. June 3, 2021), opinion (Cornell LII reproduction) (reproduction of official text, checked 2026-11-02). An individual "exceeds authorized access" when he accesses a computer with authorization but obtains information in particular areas, such as files, folders or databases, that are off-limits to him; a gates-up-or-down inquiry; purpose-based misuse of access he had was not enough; footnote 8 leaves open whether the inquiry turns only on technological limits or also on limits in contracts or policies.
- U.S. Department of Justice, Justice Manual 9-48.000, Computer Fraud and Abuse Act (updated May 2022) (regulator, checked 2026-11-02). DOJ charging policy: "without authorization" requires no authorization by any person with authority to grant it and knowledge; "exceeding" requires an area divided in a computational sense, authorization to some areas but unconditional prohibition on others, and knowledge; prosecutors should decline when the evidence shows good-faith security research as defined; unambiguous written revocation; the policy creates no enforceable right.
Frequently asked questions
Is this legal advice?
No. It is educational practice with fictional clients. Rules vary by jurisdiction and change, so check current primary sources and take advice from a qualified lawyer. If you are a researcher or a company with a real situation, speak to a lawyer before acting.
Does good-faith security research protect me from prosecution?
Not automatically. In the US, DOJ charging policy tells federal prosecutors to decline good-faith security research as it defines it, but the policy is internal guidance and creates no enforceable right. In England, the Computer Misuse Act text read for this lab has no express research defence, and good faith is considered at the public-interest and sentencing stages.
What did Van Buren decide?
The US Supreme Court held that a person exceeds authorized access under the CFAA when he obtains information in areas of a computer that are off-limits to him, and rejected a reading based on the user's purpose. It left open whether the limits must be technological or can also come from contracts and policies.
Does a bug bounty programme make my testing legal?
The programme terms are a source of consent for the activity they cover. Testing outside the stated scope may not be covered, and what follows depends on the jurisdiction and the facts. The lab teaches reading and documenting scope.
Do I need Pro to use the lab?
The lab is free to try with 3 Pro tool runs in total, shared across all Pro tools. Downloading the memos and register is Pro only.
Where do the rules come from?
Each fact pattern lists the statutes, opinions and official guidance opened to check it, with the date checked. The Sources block on the page shows them all.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.