Hate speech is a contextual phenomenon. What offends or inflames in one context may differ from what incites violence in a different time, place, and cultural landscape. Theories of hate speech, especially Susan Benesch’s concept of “dangerous speech” (hateful speech that incites violence), have focused on the factors that cut across these paradigms. However, the existing scholarship is narrowly focused on situations of mass violence or societal unrest in America or Europe.

The Computer Fraud and Abuse Act (CFAA) provides a civil cause of action for computer hacking victims that have suffered certain types of harm. Of these harms, the one most commonly invoked by plaintiffs is having suffered $5,000 or more of cognizable “loss” as defined by the statute. In its first-ever CFAA case, 2021’s Van Buren v. United States, the Supreme Court included intriguing language that “loss” in civil cases should be limited to “technological harms” constituting “the typical consequences of hacking.” To date, lower courts have only followed the Court’s interpretation if their circuit already interpreted “loss” narrowly pre-Van Buren and have continued to approach “loss” broadly otherwise.

Van Buren did not fully dissipate the legal risks the CFAA has long posed to a particular community: people who engage in good-faith cybersecurity research. Discovering and reporting security vulnerabilities in software and hardware risks legal action from vendors displeased with unflattering revelations about their products’ flaws. Research activities have even led to criminal investigations at times. Although Van Buren narrowed the CFAA’s scope and prompted reforms in federal criminal charging policy, researchers continue to face some legal exposure. The CFAA still lets litigious vendors “shoot the messenger” by suing over security research that did them no harm. Spending just $5,000 addressing a vulnerability is sufficient to allow the vendor to sue the researcher who reported it, because such remediation costs qualify as “loss” even in courts that read that term narrowly.

To mitigate the CFAA’s legal risk to researchers, a common proposal is a statutory safe harbor for security research. Such proposals walk a fine line between being unduly byzantine for good-faith actors to follow and lax enough to invite abuse by malicious actors. Instead of the safe harbor approach, this article recommends a simpler way to reduce litigation over harmless research: follow the money.

The Article proposes (1) amending the CFAA’s “loss” definition to prevent vulnerability remediation costs alone from satisfying the $5,000 standing threshold absent any other alleged loss, and (2) adding a fee-shifting provision that can be invoked where plaintiffs’ losses do not meet that threshold. Tightening up the “loss” calculus would disqualify retaliatory litigation against beneficial (or at least benign) security research while preserving victims’ ability to seek redress where well-intended research activities do cause harm. Fee-shifting would deter weak CFAA claims and give the recipients of legal threats some leverage to fight back. Coupled with the Van Buren decision, these changes would reach beyond the context of vendor versus researcher: they would help rein in the CFAA’s rampant misuse over behavior far afield from the law’s core anti-hacking purpose.

On December 2, 2021, Twitter announced that it had suspended a network of accounts that engaged in a political spam operation in support of the Venezuelan government. According to Twitter’s attribution language, real people were encouraged to engage in spammy behaviors to show their support for Nicolás Maduro and his political party. According to Twitter, financial compensation may have been offered to accounts for sufficient engagement in bolstering Maduro’s messaging. Our assessment of the accounts shared suggested that the set may be more accurately characterized as four or five distinct groups linked to each other only by mentions of common public figures or popular hashtags and by behavior that violates similar parts of Twitter’s policies. The network included accounts that reported locations in Venezuela, Colombia and Mexico, and engaged in automated tweeting behavior through the use of bots and feeds. The three regional groups were distinct and tweeted about different topics. In our assessment, we could not verify that these accounts were directly linked to tweet-for-hire schemes, although the Venezuelan accounts used behaviors described in prior reporting on this tactic. Other accounts in the network shared behavior similar to more commercial tweet-for-hire schemes: they promoted a mix of commercial brands and political hashtags. The accounts that reported their location as Mexico specifically engaged in behavior that amplified support for regional Mexican politicians. Shortly before the network was suspended, a small cluster of new accounts accounts furiously tweeted for the release of Alex Saab, a close ally of the Venezuelan president who was recently extradited from Cape Verde and is currently awaiting trial in Miami on charges of money laundering.