I thought the CFAA, like the UK equivalent Computer Misuse Act 1990, governed unauthorised access to computer systems and data. Seems appropriate to me.<p>Paper files would probably be locked up - the equivalent prosecution would then be something like trespass, breaking and entering, or what have you.<p>If you have access to data for operational purposes then access outside of operational needs is just unauthorised access which on computer systems is an offence in itself because physical access is already historically covered under various laws.