The penalties for illegally accessing a computer under federal law range from up to one year in prison for a basic first-offense intrusion to up to twenty years for serious or repeat conduct, with fines reaching $250,000, mandatory forfeiture of the equipment used, court-ordered restitution to victims, strict restrictions on device and internet use after release, and civil lawsuits from anyone harmed by the access. The Computer Fraud and Abuse Act (CFAA) sets these consequences at the federal level, and most states have their own computer crime laws that can apply to the same conduct.
What the Law Treats as Illegal Access
Federal law recognizes two forms of illegal access. The first is getting into a system without any authorization: stolen credentials, exploited vulnerabilities, guessed passwords. The second is having limited authorization and going beyond it, such as an employee cleared for certain company files who then pulls executive financials or personnel records.
The Supreme Court narrowed that second category in Van Buren v. United States (2021). A person “exceeds authorized access” only by obtaining information from areas of the computer that are off-limits to them. Using information you are otherwise authorized to see for an improper purpose does not violate the CFAA, even if it violates workplace policy.
The Department of Justice issued revised policy in 2022 saying federal prosecutors should not bring CFAA charges based solely on someone breaking a website’s terms of service. Charges can still follow when someone accesses another person’s account without permission, or keeps accessing a system after receiving unambiguous written notice that authorization has been revoked.
Prison Time and Fines by Offense Tier
CFAA penalties are tiered. The maximum sentence depends on what the person did, why they did it, and how much harm resulted.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
Misdemeanor Tier: Up to One Year
Simple unauthorized access carries up to one year in prison and a fine of up to $100,000. This covers basic intrusions into government computers, obtaining information through unauthorized access without aggravating circumstances, and trafficking in passwords, under sections 1030(a)(2), (a)(3), and (a)(6). The $100,000 ceiling comes from the general federal fine statute, which caps fines for Class A misdemeanors not resulting in death at that amount.2Office of the Law Revision Counsel. 18 US Code 3571 – Sentence of Fine
Five-Year Felony Tier
The maximum jumps to five years when certain aggravating factors are present. For unauthorized access to obtain information, the offense becomes a felony if any of the following applies:
- The access was for commercial advantage or private financial gain.
- The access was committed to further another criminal or harmful act.
- The value of the information obtained exceeds $5,000.
Computer fraud and extortion-related threats, including the threats typical of ransomware cases, also carry up to five years for a first offense. Intentional damage to a protected computer that causes at least $5,000 in aggregate loss during any one-year period falls into this same tier.
Ten-Year Felony Tier
The most serious first-offense penalties reach ten years. Accessing a computer to obtain national defense or foreign relations information carries this maximum, as does knowingly causing serious damage to a protected computer through the intentional transmission of harmful code or commands. Felony fines can reach $250,000 for an individual.2Office of the Law Revision Counsel. 18 US Code 3571 – Sentence of Fine
Enhanced Penalties for a Second Offense
The CFAA roughly doubles the maximum sentence for anyone convicted of a second or subsequent offense:
- Espionage-related access: up to 20 years, doubled from 10.
- Unauthorized access to obtain information, government trespassing, and password trafficking: up to 10 years, up from 1.
- Computer fraud and extortion threats: up to 10 years, doubled from 5.
- Intentional damage to protected computers: up to 20 years, doubled from 10.
The 20-year maximum is the harshest sentence the statute imposes short of the life imprisonment provision that applies when computer damage results in a death.3Congressional Research Service. Cybercrime: An Overview of 18 USC 1030 and Related Federal Criminal Laws
Mandatory Forfeiture and Restitution
Prison and fines are not the only financial consequences. The CFAA requires courts to order convicted defendants to forfeit the personal property used to commit the offense, including computers, servers, storage devices, and networking equipment, along with any property or proceeds derived from the crime. The statute says the court “shall order” forfeiture, and the requirement applies regardless of any conflicting state law.
Restitution is also mandatory. Under the Mandatory Victims Restitution Act, courts must order offenders to compensate victims for property loss, the cost of responding to the attack and restoring compromised systems, lost revenue from service interruptions, and expenses victims incurred helping with the investigation and prosecution. Unlike a civil judgment, which the victim has to pursue separately, restitution is part of the criminal sentence and is ordered by the judge at sentencing.4Office of the Law Revision Counsel. 18 US Code 3663A – Mandatory Restitution to Victims of Certain Crimes
Restrictions After Release
Convicted computer offenders often face tight conditions during probation or supervised release. Federal courts work from a dedicated framework of cybercrime management conditions. These restrictions apply not just to traditional computers but to any internet-connected device: smartphones, tablets, smart watches, gaming consoles, voice assistants, connected TVs.5United States Courts. Chapter 3: Cybercrime-Related Conditions (Probation and Supervised Release Conditions)
At the most restrictive end, a judge can prohibit the use of any computing device at all. More commonly, courts require monitoring software on every device the person owns, restrict or eliminate internet access, limit what types of devices they can possess, and set tailored rules on how those devices may be used. For someone whose work depends on technology, these conditions can be as disruptive as the prison term. They usually last the full length of supervised release, which can run several years after the sentence ends.
Civil Lawsuits From Victims
Even if the government never files charges, the CFAA lets victims sue in civil court. Anyone who suffers damage or loss from a CFAA violation can bring a lawsuit for compensatory damages and injunctive relief, provided the claim involves at least one qualifying harm factor: aggregate loss of $5,000 or more, impairment of medical care, physical injury, a threat to public health or safety, or damage to a government computer used for national security or justice administration.
When the only qualifying factor is monetary loss, recoverable damages are limited to economic damages: the cost of responding to the breach, repairing systems, conducting a damage assessment, and any lost revenue from interrupted service. Emotional distress and reputational harm are not recoverable under that limitation. A civil CFAA claim must be filed within two years of either the unauthorized access or the victim’s discovery of the damage, whichever is later.
The $5,000 loss threshold is where many civil CFAA claims succeed or fail. Courts read “loss” broadly to include reasonable costs of investigating a breach and restoring systems, not just the value of stolen data. A company that spends $3,000 investigating a minor intrusion with no other harm may not have a viable federal claim, which is why many businesses pursue state-law claims alongside or instead of a CFAA suit.
State Charges on Top of Federal
Nearly every state has its own computer crime statute with its own definitions and penalty structure. A single intrusion can be prosecuted at both the federal and state level, so the federal exposure described above is often not the full picture.6National Association of Attorneys General. Cybercrimes