> Certainly ordinary physical property law makes is an offense to trespass regardless of whether you are trespassing with malicious intent.

In the case of physical property the most common remedies for trespassing are either an injunction prohibiting future trespassing on the same property or a modest fine (e.g. $100). Applying the same penalties to the equivalent behavior in the computer context would be completely reasonable, but that empirically isn't what happens, because the CFAA is defective.

I basically agree - though I hasten to add that I never said anything about what penalty a person would actually receive or whether it is appropriate. I do think that it makes sense for "computer tresspass" to be punished more harshly than tresspass to physical property. It takes a lot more effort to break into a server than it does to walk through someone's door (or into their yard), so I think the baseline level of culpability is higher (though bear in mind that these are generalizations). There is also a lot more risk involved in a "casual" computer tresspass. But I agree with you that this doesn't gets us to the maximum CFAA sentence.

This gets us into complicated territory, though. There are very few people who have ever actually been sentenced to the maximum CFAA penalty. (I'm actually aware of none.) The actual punishments actually imposed are often, I think, fairly reasonable.

Of course, there are plenty who have been threatened with the huge maximum by federal prosecutors, but this is no different from any other crime. Of course federal prosecutors will menace defendants with the maximum possible penalty. They want to extract a guilty plea, and it would also be dangerous for them to claim that any shorter penalty than the maximum applied, since they do no actually control sentencing. (Imagine the controversy if the U.S. Attorney told a defendant that he was only realistically looking at 6 months but the judge gave him 2 years.) It's the defense attorney's role to make sure that her client has a realistic understanding of the likely punishment, not the government's.

What's really needed is a replacement for CFAA (and, for that matter, most other criminal statutes) with more carefully graded maximum sentences, but I've never heard a realistic proposal about how such a law would work.

This isn't quite trespassing, though: this is breaking and entering (without malicious intent). This is someone noting that your door lock is easily pickable and then going on a quest to see just how far they can get, maybe finding a key to the car in the garage and then going into their glove compartment. The equivalent situation with physical property is clearly "criminal".

The Law should have a case for the need to ignore some rights in order to protect other rights, given that any damage will be compensated. E.g. break a window to get someone out of a car crash. Seeing that he didn't do any damage, it should be fine. I know that's the case in German civic law. Intent is regularly a deciding factor in measure of punishment. This may as well go without a warning.

If you walk by a house seeing someone crack a window and crawl in, do you think it's morally acceptable to trespass on the property to ascertain whether this is a burglary in progress or someone who forgot their key? (This case seems somewhere between my and your example.)

Stop the allegories already. This is unlawful computer access, not burglary. There is nothing to be gained from comparing with unrelated crimes, neither moral understanding nor any understanding of judicial consequences.

Perhaps, but this case is more like walking by a house, seeing a cracked window, and crawling in yourself to take a look around and see if anyone else might have done the same.