Computer Crimes: Federal Laws, CFAA Penalties, and Victim Remedies

Federal computer crimes are offenses prosecuted under the Computer Fraud and Abuse Act and a handful of related statutes that criminalize unauthorized access to internet-connected systems, digital fraud, interception of electronic communications, and damage to protected computers. Penalties run from one year in prison for basic unauthorized access up to 20 years for attacks that threaten public safety or come from repeat offenders.¹ Most indictments stack several charges, so the headline number from any single statute tells only part of the story.

What Conduct Counts as a Federal Computer Crime

A few patterns of behavior drive almost every federal computer crime prosecution.

Unauthorized access is the simplest. Someone breaks into a system they have no permission to use by bypassing a password, exploiting a vulnerability, or logging in with stolen credentials. It also covers people who have limited legitimate access but push into restricted areas, like an employee with rights to one database snooping through files on another department’s server.

Malware and ransomware involve writing or deploying software designed to damage systems, steal data, or lock users out of their own files. Ransomware encrypts a victim’s data and demands payment for the decryption key. Attacks on hospitals, school districts, and municipal governments draw the harshest treatment because they threaten public health and safety.

Phishing uses fake emails, websites, or messages that imitate legitimate businesses to trick people into handing over passwords, Social Security numbers, or financial information. Technical quality varies from near-perfect bank login clones to crude mass emails full of typos. If the scheme uses electronic communications to defraud, it falls under both the computer fraud statutes and the federal wire fraud law.

Denial-of-service attacks flood a server or website with enough traffic to shut legitimate users out. Attackers often coordinate networks of compromised devices to overwhelm the target. Lost revenue and recovery costs usually push these cases into felony territory quickly.

The Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act, codified at 18 U.S.C. § 1030, is the primary federal statute for computer crimes.¹ Its reach is wide because the law defines a “protected computer” as any computer used in or affecting interstate or foreign commerce or communication, which in practice covers essentially any device connected to the internet. It also specifically covers computers used by financial institutions, the federal government, and voting systems.²

The CFAA prohibits several distinct offenses:

Accessing a computer without authorization to obtain restricted government, financial, or other protected information
Computer fraud, where someone accesses a protected computer without permission and uses that access to further a fraud scheme and obtain something of value
Intentionally damaging a protected computer through unauthorized transmission of programs, code, or commands
Trafficking in passwords or similar access credentials
Extortion involving a threat to damage a computer or release stolen data unless paid

The statute supports both criminal prosecution and private civil lawsuits by victims seeking compensation.

What “Without Authorization” Actually Means

The CFAA never defines “without authorization,” and for years courts split on whether a person with legitimate access who misused information committed a federal crime. The Supreme Court resolved the question in Van Buren v. United States. A police officer had used his patrol-car computer to search a license plate database in exchange for money, violating department policy. The Court held that the CFAA’s “exceeds authorized access” clause applies only when someone reaches areas of a system that are off-limits to them, not when they look at information they are entitled to see but use for an improper purpose.³

The practical result is a “gates-up-or-down” test. If your credentials get you through the gate to a file, accessing it does not violate the CFAA even if you use it for a bad reason. If the system blocks you and you work around that block, you have exceeded your authorized access. For employees and contractors, this means breaking an acceptable-use policy alone does not trigger federal criminal liability under the CFAA. Your employer can still fire you and sue under other laws, but the federal computer crime statute stays out of it.

Other Federal Statutes Prosecutors Add

Most computer crime indictments combine the CFAA with other federal charges, and those additional statutes often carry heavier penalties than the CFAA itself.

Wire Fraud

The federal wire fraud statute, 18 U.S.C. § 1343, criminalizes using electronic communications to carry out any scheme to defraud someone of money or property. Because nearly every internet scam crosses state lines, wire fraud is among the most commonly charged federal offenses in computer crime cases. A first offense carries up to 20 years in prison, and if the fraud targets a financial institution, the maximum rises to 30 years and a $1 million fine.⁴

Wiretapping and Stored Communications

The Electronic Communications Privacy Act covers two separate scenarios. The Wiretap Act, 18 U.S.C. § 2511, criminalizes intercepting electronic communications in transit, such as capturing emails or eavesdropping on internet voice calls without authorization.⁵ The Stored Communications Act, 18 U.S.C. § 2701, separately criminalizes breaking into systems where communications are stored, like email servers or cloud accounts. A first offense committed for commercial gain or to further another crime carries up to five years, with up to ten years for repeat offenders.⁶

Aggravated Identity Theft

When a computer crime involves someone else’s personal identifying information, prosecutors frequently add a charge under 18 U.S.C. § 1028A. This statute carries a mandatory two-year prison sentence that runs consecutively to any sentence for the underlying computer offense. Judges cannot reduce the sentence on the underlying crime to offset it, and probation is not available.⁷ That mandatory add-on is where plea negotiations in computer crime cases often get difficult.

The CAN-SPAM Act

The CAN-SPAM Act, 15 U.S.C. § 7701 and following, targets deceptive commercial email. It requires senders to use accurate subject lines, identify messages as advertisements, include a valid physical address, and provide a working opt-out mechanism.⁸ State enforcement actions can produce damages of up to $250 per unlawful message, capped at $2 million for most violations and tripled to $6 million for willful conduct.⁹

Penalties Under the CFAA

The CFAA’s penalty structure is tiered by offense type, intent, resulting harm, and whether the defendant has prior convictions.¹ The major categories break down this way:

Unauthorized access to obtain information: up to 1 year for a first offense. If the access was for commercial gain, to further another crime, or the information taken exceeds $5,000 in value, the maximum rises to 5 years. A repeat conviction doubles that to 10 years.
Computer fraud (accessing a system to further a fraud scheme): up to 5 years for a first offense, 10 years for a second.
Intentional damage to a protected computer: up to 5 years when aggregate losses reach at least $5,000 in a one-year period. Up to 10 years if the damage creates a threat to public health or safety. Up to 20 years if someone dies as a result. Repeat offenders face up to 20 years regardless of harm level.
Extortion involving threats to a computer: up to 5 years for a first offense, 10 years for a repeat conviction.
Trafficking in computer passwords: up to 1 year for a first offense, 10 years after a prior conviction.

The $5,000 Loss Threshold

The $5,000 figure appears throughout the CFAA and controls when conduct crosses from misdemeanor to felony and when a victim can bring a civil claim. For damage offenses, aggregate losses of at least $5,000 over a one-year period push the offense to felony-level punishment. Other triggers at the same level include threats to public health or safety, physical injury, and damage to government systems.

“Loss” is defined broadly. It includes the cost of responding to the incident, conducting a damage assessment, restoring data and systems to their pre-offense state, and any revenue lost or consequential damages from interrupted service.² Once you factor in incident response, forensic analysis, and system rebuilds, a single compromised server will often cross $5,000 on its own.

What Victims Can Do

Victims have two financial-recovery paths that don’t depend on waiting for a prosecution to go their way: a private civil suit under the CFAA and court-ordered restitution at sentencing.

Private Civil Suits Under the CFAA

Any person who suffers damage or loss from a CFAA violation can sue for compensatory damages and injunctive relief, provided the violation caused one of these: aggregate losses of $5,000 or more in a one-year period, a threat to public health or safety, physical injury, interference with medical care, or damage to a government computer.² If the $5,000 loss threshold is the only qualifying factor, damages are limited to economic losses.

The statute of limitations is two years from the date of the act or the date the damage is discovered, whichever is later. After Van Buren, courts have narrowed civil CFAA claims to cases involving actual technological harm, such as corrupted files or disabled systems. Copying data without damaging the underlying system may not be enough to sustain a civil claim, even if the access was unauthorized.³

Restitution at Sentencing

When a federal prosecution results in a conviction, the court can order the defendant to pay restitution. For property damage or destruction, the defendant must pay an amount equal to the value of the property on the date it was damaged or on the date of sentencing, whichever is greater.¹⁰ Victims can also recover lost income, necessary expenses from participating in the investigation or prosecution, and in cases involving bodily injury, the cost of medical care, therapy, and rehabilitation. Collection is a separate problem, since many defendants have limited assets, but the right to restitution is real and enforceable.

Reporting a Computer Crime

Victims should file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov, the central intake hub for cyber-enabled crime reports. The information helps the FBI investigate, track trends, and in some cases freeze stolen funds before they move.¹¹ The FBI cannot respond to every report individually, but filing creates a record that matters if the case later connects to a larger investigation. Businesses facing an active intrusion often get faster results by contacting an FBI field office directly. Crimes against children should go to the National Center for Missing and Exploited Children, and terrorism-related threats to tips.fbi.gov rather than the IC3.

State Laws Operate Alongside Federal Law

Every state, plus Puerto Rico and the Virgin Islands, has its own computer crime statutes that run parallel to federal law. Most states criminalize unauthorized access or computer trespass, and many specifically address ransomware, spyware, phishing, and denial-of-service attacks. A single act of hacking can violate both state and federal law at once, and prosecutors at each level decide independently whether to charge. Penalties vary: some states treat basic unauthorized access as a misdemeanor with modest fines, while others classify the same conduct as a felony carrying multiple years in prison. In cases involving victims in multiple states, federal prosecutors are more likely to take the lead because the CFAA’s jurisdiction reaches any computer used in interstate commerce.

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
2
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
3
Supreme Court of the United States. Van Buren v. United States
4
Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
5
Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited
6
Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
7
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
8
Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business
9
Office of the Law Revision Counsel. 15 USC 7706 – Enforcement Generally
10
Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes
11
Internet Crime Complaint Center (IC3). Internet Crime Complaint Center