Federal penalties for cyberterrorism are not set by any single statute. Prosecutors combine computer-crime charges under the Computer Fraud and Abuse Act with federal terrorism laws, and the sentencing guidelines’ terrorism enhancement does most of the heavy lifting on prison time. A first-time offender who would otherwise face a few years for damaging a protected computer can be looking at 12 to 15 years or more once the enhancement applies, and any attack that kills someone opens the door to life imprisonment or, under the transnational terrorism statute, the death penalty.
Why There Is No Single Cyberterrorism Statute
No federal law uses “cyberterrorism” as a standalone offense. Prosecutors work from the definition of domestic terrorism in 18 U.S.C. § 2331, which covers acts dangerous to human life that violate federal or state criminal law and appear intended to intimidate or coerce a civilian population, influence government policy through intimidation or coercion, or affect government conduct through mass destruction, assassination, or kidnapping.1Office of the Law Revision Counsel. 18 U.S. Code 2331 – Definitions
Intent is what moves a case from cybercrime into terrorism territory. Breaking into servers to steal credit card numbers is ordinary computer fraud. Attacking the same servers to spread public fear or pressure a government into changing policy triggers the terrorism statutes and the sentencing enhancement that turns a five-year computer fraud exposure into decades.
Computer Fraud and Abuse Act Prison Terms
The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, is the backbone of federal cyberattack prosecutions. It criminalizes unauthorized access to “protected computers,” a category broad enough to cover any internet-connected device because any computer used in interstate commerce qualifies.2Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers Two subsections do the work in cyberterrorism cases: § 1030(a)(1) for accessing national defense information, and § 1030(a)(5)(A) for intentionally causing damage.
The maximum prison terms climb with the harm done:
- Accessing national defense information: up to 10 years for a first offense, up to 20 years for a repeat offender.
- Intentionally damaging a protected computer where qualifying harms are met: up to 10 years for a first offense, up to 20 years for a repeat offender.
- Recklessly damaging a protected computer with qualifying harm: up to 5 years for a first offense, up to 20 years for a repeat offender.
- Intentional damage causing serious bodily injury: up to 20 years.
- Intentional damage causing death: any term of years, up to life.
The qualifying harms that elevate a CFAA offense include aggregate losses of at least $5,000 in a year, interference with medical care, physical injury, a threat to public health or safety, damage to a government computer used for national defense or security, and damage affecting 10 or more protected computers in a year.2Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers A single infrastructure attack usually triggers several of these at once. An intrusion into a hospital network, for instance, hits the medical-care, public-safety, and multi-computer thresholds simultaneously.
Terrorism Charges Layered on Top
When a cyberattack crosses national borders, prosecutors can also charge under 18 U.S.C. § 2332b, which covers conduct that transcends national boundaries and creates a substantial risk of serious bodily injury through destruction or damage of U.S. property.3Office of the Law Revision Counsel. 18 U.S. Code 2332b – Acts of Terrorism Transcending National Boundaries The penalties track the resulting harm:
- Death: death penalty, or any term of years up to life.
- Maiming: up to 35 years.
- Assault causing serious bodily injury: up to 30 years.
- Destroying or damaging property: up to 25 years.
- Threatening to commit a § 2332b offense: up to 10 years.
Two features of § 2332b matter at sentencing. Probation is unavailable for any conviction, and the prison term must run consecutively with any other sentence the defendant is serving.3Office of the Law Revision Counsel. 18 U.S. Code 2332b – Acts of Terrorism Transcending National Boundaries A defendant convicted of both CFAA charges and a § 2332b count serves the terms back to back, not concurrently.
Material Support Charges for Coders and Operators
Writing malware, building intrusion tools, or lending technical expertise can be charged separately as material support. Under 18 U.S.C. § 2339A, “material support” includes “expert advice or assistance” derived from specialized knowledge, and that reaches programming and network exploitation skills. Providing the support while knowing it will be used in a federal crime of terrorism carries up to 15 years, or life if anyone dies.4Office of the Law Revision Counsel. 18 U.S. Code 2339A – Providing Material Support to Terrorists
The companion statute, 18 U.S.C. § 2339B, criminalizes providing material support to a designated foreign terrorist organization even without knowledge of any specific planned attack. The maximum is 20 years, or life if death results.5Office of the Law Revision Counsel. 18 U.S. Code 2339B – Providing Material Support or Resources to Designated Foreign Terrorist Organizations A programmer who builds custom tooling for a group on the State Department’s foreign terrorist organization list faces § 2339B exposure whether or not the tool is ever used.
The Sentencing Enhancement That Changes Everything
The federal sentencing guidelines contain a terrorism enhancement at § 3A1.4 that rewrites the arithmetic. If the court finds the felony involved or was intended to promote a federal crime of terrorism, the enhancement adds 12 offense levels, sets a floor of level 32, and automatically places the defendant in Criminal History Category VI, the highest category, regardless of prior record.6United States Sentencing Commission. USSG 3A1.4 – Terrorism
The practical effect is severe. A first-time offender convicted of intentionally damaging a protected computer might see a guidelines range of roughly two to three years in ordinary circumstances. With the terrorism enhancement, the same defendant faces a range starting around 12 to 15 years, and more depending on offense characteristics. Most of the length of a cyberterrorism sentence comes from this enhancement rather than from any single statutory maximum.
Fines, Restitution, and Lifetime Supervision
The baseline fine for an individual convicted of a federal felony is $250,000 under 18 U.S.C. § 3571. An alternative provision lets the court impose a fine of up to twice the defendant’s gross gain or twice the victims’ gross loss, whichever is greater.7Office of the Law Revision Counsel. 18 U.S. Code 3571 – Sentence of Fine For attacks that inflict millions in damage, the alternative fine dwarfs the baseline.
Restitution is mandatory under the Mandatory Victims Restitution Act when offenses involve property damage or physical injury with identifiable victims. The defendant repays the full cost of the harm, including response costs, damage assessments, and system restoration.8Office of the Law Revision Counsel. 18 U.S. Code 3663A – Mandatory Restitution to Victims of Certain Crimes For large-scale infrastructure attacks, restitution can reach tens of millions.
Prison is not the end of the sentence. Under 18 U.S.C. § 3583(j), the authorized term of supervised release for any offense listed in the terrorism predicates of § 2332b(g)(5)(B) is “any term of years or life.”9Office of the Law Revision Counsel. 18 U.S. Code 3583 – Inclusion of a Term of Supervised Release After Imprisonment Courts routinely use that authority to impose lifetime restrictions on computer access, internet use, and employment in technology fields.
How Loss Drives the Guidelines Number
Dollar loss sets the offense level under USSG § 2B1.1, which defines loss as the greater of actual loss or intended loss. Actual loss is the reasonably foreseeable financial harm; intended loss is the harm the defendant purposely tried to inflict, even if impossible to achieve.10United States Sentencing Commission. USSG 2B1.1 – Larceny, Embezzlement, and Other Forms of Theft
For CFAA offenses, the guidelines expand actual loss beyond the “reasonably foreseeable” cap to include any reasonable cost of responding to the attack, conducting a damage assessment, restoring data and systems to their prior condition, and any lost revenue or other costs from service interruptions. That broader definition captures the full cleanup bill, which in infrastructure attacks typically exceeds the direct damage. Courts can estimate loss using the fair market value of destroyed data, the cost of developing stolen proprietary information, or the number of affected victims multiplied by average per-victim loss.
Civil Exposure on Top of Criminal Penalties
Victims of cyberattacks that qualify as international terrorism have their own cause of action. Under 18 U.S.C. § 2333, any U.S. national injured in person, property, or business by an act of international terrorism can sue for treble damages plus the cost of the suit and attorney’s fees.11Office of the Law Revision Counsel. 18 U.S. Code 2333 – Civil Remedies
The Justice Against Sponsors of Terrorism Act went further, stripping foreign states of sovereign immunity when a cyberattack constituting international terrorism causes physical injury, property damage, or death inside the United States, provided the foreign state committed a tortious act beyond mere negligence that contributed to the attack. U.S. courts have exclusive jurisdiction, though the Attorney General can seek a stay of up to 180 days, renewable, if the State Department certifies that diplomatic negotiations are underway.12GovInfo. Justice Against Sponsors of Terrorism Act (Public Law 114-222)
Treble damages run alongside the criminal restitution order, not instead of it. A defendant convicted of a cyberterrorism offense can face a prison term measured in decades, a fine tied to the full loss figure, mandatory restitution covering every dollar of response and recovery, supervised release that may last the rest of their life, and separate civil judgments from every victim who can establish an international terrorism claim.