The Computer Fraud and Abuse Act (CFAA) criminalizes unauthorized computer access - Bug bounty programs provide explicit authorization, creating a legal safe harbor - The Department of Justice issued a 2022 policy stating that good-faith security research should not be prosecuted under the CFAA - Ho