Is Deleting Company Files a Crime? Penalties and Defenses

Deleting company files is a crime when you did it on purpose, you were not authorized to destroy that data, and the deletion caused real harm. Under the federal Computer Fraud and Abuse Act, intentionally destroying data on a work computer or company server can carry up to 10 years in prison for a first offense, plus fines, mandatory restitution, and a separate civil lawsuit from your former employer. An accidental deletion, or a cleanup you were told to perform, is a different matter. The line between a fireable mistake and a prosecutable act comes down to three things: what you meant to do, what you were permitted to do, and what it cost the company.

When a Deletion Crosses From Mistake to Crime

Two elements separate a bad day at work from a federal charge: intent and authorization.

Accidentally dragging a folder into the trash while cleaning your desktop is not a crime. Prosecutors go after deliberate acts, where someone chose to destroy information to hurt the company, cover up wrongdoing, or walk out with an advantage.

Authorization is the piece that catches people off guard. Having a login does not mean you have permission to delete anything you can see. A salesperson with access to customer records can update notes and contact details. That same salesperson has no authorization to wipe the client database. The gap between what you can technically reach and what you are permitted to destroy is where criminal liability sits.

A separate CFAA provision targets anyone who accesses a protected computer with intent to defraud and gets something of value from it. When an employee deletes files to cover up embezzlement or to clear evidence of taking data to a competitor, that provision can stack on top of the damage charges. A first offense under it carries up to five years; a repeat offense doubles to ten.¹

The Federal Law That Applies

The main federal statute is the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. It covers any “protected computer,” which the statute defines broadly enough to include essentially any device connected to the internet or used in interstate commerce.¹ Your work laptop, your desktop at the office, the company server, cloud storage — all qualify.

The provision prosecutors reach for in deletion cases is subsection (a)(5). It covers three mental states, from most to least severe: knowingly transmitting a command that intentionally causes damage without authorization; intentionally accessing a computer without authorization and recklessly causing damage; and intentionally accessing a computer without authorization and causing damage even without reckless conduct. The statute defines “damage” as any impairment to the integrity or availability of data, a program, a system, or information. Deleted files fit squarely inside that definition.¹

The $5,000 Loss Threshold

For several CFAA provisions to apply, the government must show at least $5,000 in losses during any one-year period. That sounds high until you read the definition. “Loss” includes the cost of responding to the offense, conducting a damage assessment, restoring data to its prior condition, and any revenue lost from interrupted service.¹ Once a company hires a forensic specialist and pulls IT staff off their regular work to investigate, $5,000 goes by quickly. The threshold is far lower in practice than the number suggests.

Why “I Had Access to Those Files” Is Not a Defense

In 2021, the Supreme Court decided Van Buren v. United States, a case about a police officer who ran a license plate search in exchange for a bribe. He had legitimate access to the database, so the Court held he had not “exceeded authorized access” under the CFAA, even though his motive was corrupt.² The ruling means that misusing information you were allowed to see does not, by itself, trigger the “exceeds authorized access” clause.

Here is what Van Buren did not do: it did not make file deletion safe. The decision was about accessing and obtaining information, not destroying it. The CFAA’s damage provision in subsection (a)(5) operates on its own and criminalizes intentionally causing damage without authorization regardless of whether the employee was permitted to access the files. The Supreme Court itself pointed to the scenario of an employee who, “minutes before resigning, deletes every file on a computer” as a situation the statute still reaches through other provisions.²

The takeaway: being allowed to read a file is not the same as being allowed to destroy it. Prosecutors who charge damage, not access, are not blocked by Van Buren.

Deleting Files During an Investigation or Lawsuit

Deletion gets dramatically more dangerous when there is an investigation or legal dispute in the picture. Two federal obstruction statutes carry penalties that dwarf typical computer fraud charges.

Under 18 U.S.C. § 1519, anyone who destroys a record with intent to obstruct a federal investigation faces up to 20 years in prison.³ The provision is broad. It does not require that charges have been filed or that a formal investigation is open. Destruction “in contemplation of” a federal matter is enough. An employee who deletes emails to get ahead of a regulatory inquiry can be prosecuted even if the inquiry has not officially begun.

A related statute, 18 U.S.C. § 1512(c), makes it a crime to corruptly destroy any record with the intent to impair its availability in an official proceeding. The maximum there is also 20 years.⁴

Even outside criminal investigations, a legal duty to preserve files kicks in as soon as you know or should know that litigation is likely. Deleting after that point is called spoliation. Under Federal Rule of Civil Procedure 37(e), a court that finds a party intentionally destroyed electronically stored information to deprive the other side of its use can instruct the jury to presume the deleted files were unfavorable, or even enter a default judgment against the destroying party.⁵ That kind of sanction can decide a case all by itself.

Penalties If You Are Convicted

Federal penalties under the CFAA scale with intent and prior history:

Intentional damage, first offense: up to 10 years in prison, when the conduct caused at least $5,000 in losses or triggered another qualifying harm, such as affecting 10 or more computers.
Reckless damage, first offense: up to 5 years under the same qualifying conditions.
Damage with loss but without reckless or intentional conduct, first offense: up to 1 year.
A second intentional-damage offense carries up to 20 years.

Fines come on top. Under the general federal sentencing statute, an individual convicted of a felony faces fines up to $250,000.⁶ The actual number depends on the financial harm and the circumstances, but the ceiling is steep.¹

Restitution is not optional. Under 18 U.S.C. § 3663A, a judge must order the defendant to pay the value of the destroyed property and the victim’s expenses from the investigation and prosecution, including forensic recovery and IT labor.⁷ The statute says “shall.” If you are convicted, you are paying.

The Civil Lawsuit That Comes With It

Criminal charges are only part of the exposure. A former employer can sue you, and it can do so even when prosecutors never file a case. The burden of proof in a civil suit is lower, so conduct that falls short of a conviction can still produce a judgment.

The CFAA itself gives victims a right to sue. Under 18 U.S.C. § 1030(g), anyone who suffers damage or loss from a CFAA violation can bring a civil action for compensatory damages and injunctive relief, provided the suit meets the $5,000 loss threshold or another qualifying harm, and is filed within two years of the date the damage was discovered.¹ This is the claim employers reach for most often because it fits the scenario exactly.

When the deleted files held proprietary information, the company may add a claim under the federal Defend Trade Secrets Act. Available remedies include actual losses, unjust enrichment, a reasonable royalty, and, if the misappropriation was willful and malicious, punitive damages up to twice the compensatory award. Attorney’s fees are recoverable in bad-faith cases.⁸

In practice, employers seek reimbursement for forensic investigation costs, IT staff time, lost revenue during the period files were unavailable, and the cost of rebuilding records from scratch. Professional forensic recovery can run from a few hundred dollars for simple cases into the tens of thousands when the deletion was thorough.

State Computer Crime Laws

All 50 states, Puerto Rico, and the U.S. Virgin Islands have their own computer crime statutes.⁹ Most cover unauthorized access, computer trespass, and destruction of data without the owner’s consent. They give state prosecutors a second route to a charge and are often easier to bring because the elements are different.

The practical difference that matters most: many state laws have no minimum damage amount. Where the CFAA requires $5,000 in losses for certain charges, a state computer tampering statute may apply to any unauthorized deletion regardless of the dollar figure. Felony thresholds vary widely. Some states move to a felony once damage passes a few thousand dollars; others set the bar much higher. The same conduct can be charged under both federal and state law.

Defenses That Actually Work

Not every deletion that infuriates an employer is a crime. A few defenses come up again and again.

The strongest is genuine authorization. If your job included managing, archiving, or deleting files, and you followed established procedures, the “without authorization” element falls apart. Written job descriptions, IT policies, and documented instructions from supervisors become critical here. An employee who can show a supervisor told them to clear out old project files has a fundamentally different case from one who wiped a drive the night before quitting.

Lack of intent is another regular defense. The most serious CFAA provisions require proof that the defendant acted intentionally or knowingly. Accidental deletion, sloppy file management, or genuine confusion about what to keep does not meet that threshold. Prosecutors must prove you meant to destroy the data, not just that you clicked the wrong button.

Van Buren narrowed what counts as exceeding authorized access. If you had unrestricted access to the files you deleted and the prosecution is relying on an “exceeds authorized access” theory, the defense can argue the access itself was authorized.² That argument has real limits when the charge is intentional damage rather than unauthorized access, but it undercuts weaker cases.

The CFAA also exempts lawfully authorized law enforcement and intelligence activities.¹ This rarely applies to ordinary employees but can matter for government contractors acting under official direction.

Extra Exposure in Regulated Industries

If you work in financial services or healthcare, deletion carries another layer of risk because regulators mandate how long records must be kept.

In financial services, SEC Rule 17a-4 requires broker-dealers to retain certain records for three to six years, and FINRA treats destruction of required books and records as a serious violation that can produce fines and disciplinary action against both the firm and the individual.¹⁰ Electronic communications, including emails and business-related messages on personal devices, are covered.

In healthcare, HIPAA’s security rule requires covered entities to protect the integrity of patient information. Unauthorized destruction of records can trigger civil penalties ranging from $145 per violation for unknowing infractions up to $73,011 per violation when the destruction was willful and uncorrected, adjusted annually for inflation. These regulatory consequences are separate from any criminal charges and multiply fast when the destruction touches many records.

If you are facing a specific accusation about files you deleted, the facts that will decide your case are the ones already in writing: your job description, your access permissions, the IT policy you agreed to, and any instructions you received. Pull those documents before talking to anyone else, and get a lawyer who handles CFAA matters before you give a statement to your former employer or to investigators.

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
2
Supreme Court of the United States. Van Buren v. United States
3
Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy
4
Office of the Law Revision Counsel. 18 USC 1512 – Tampering With a Witness, Victim, or an Informant
5
Legal Information Institute (LII) at Cornell Law School. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery
6
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
7
Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes
8
Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings
9
National Conference of State Legislatures. Computer Crime Statutes
10
FINRA. Books and Records