Is It Illegal to Boot Someone Offline? Federal and State Penalties

Yes. Booting someone offline is illegal under federal law in nearly every situation a person would ask about. The Computer Fraud and Abuse Act makes it a crime to knowingly send a program, code, or command that damages a “protected computer,” and that definition covers essentially any device connected to the internet. A first offense can carry up to ten years in prison, and the FBI treats hiring a booter service exactly the same as launching the attack yourself. On top of that, at least 26 states have their own laws against denial-of-service attacks, and the victim can sue you separately in civil court.¹

Why Booting Someone Offline Violates Federal Law

The relevant statute is 18 U.S.C. § 1030, the CFAA. It defines “damage” as any impairment to the integrity or availability of data, a program, a system, or information. Flooding someone’s connection with junk traffic so they drop off the network fits that definition directly: their system’s availability has been impaired, and you did it without authorization.²

The “protected computer” piece sometimes trips people up. The term sounds like it refers to government or corporate systems, but the statute reaches any computer “used in or affecting interstate or foreign commerce or communication.” A home router, a gaming console, a laptop on home Wi-Fi — all of them qualify once they’re on the internet. The person you’re trying to knock off an online match is using a protected computer under the statute.

How Much Prison Time You Could Face

Federal penalties under the CFAA scale with intent and prior history:

Knowingly and intentionally causing damage, first offense: up to 10 years in prison and a fine.
Intentional unauthorized access that recklessly causes damage, first offense: up to 5 years.
Intentional unauthorized access that causes damage and loss without intent to harm, first offense: up to 1 year.
A repeat offense under either of the first two categories: up to 20 years.

Most of the higher brackets require the government to show at least $5,000 in aggregate loss over a one-year period, damage affecting 10 or more computers, a threat to public health or safety, physical injury, or impairment of medical care. The $5,000 figure is easier to clear than it sounds. “Loss” under the statute includes the cost of investigating the attack, assessing the damage, restoring systems, and any revenue the victim lost while offline. If a small business goes down for a few hours and pays an IT consultant to figure out what happened, that bill alone can push the case over the threshold. Related attacks can be aggregated across a year, so a pattern of smaller disruptions adds up.²

Paying a Booter or Stresser Service Is the Same Crime

Most people who boot others offline don’t run their own attack infrastructure. They pay a few dollars for a “booter” or “stresser” subscription, which is a DDoS-for-hire platform marketed as a stress-testing tool. The FBI has been direct about how the law treats this: using one of these services against a target without the owner’s permission is a CFAA violation.³

Enforcement has escalated. The Department of Justice has charged at least nine people who ran DDoS-for-hire services and seized more than 75 domains tied to booter platforms. In one case, an Illinois man named Matthew Gatrel was sentenced to 24 months in federal prison for operating a subscription booter service, and his co-defendant got five years of probation.⁴ In announcing a later round of charges, prosecutors stated: “Whether you launch a DDoS attack or hire a DDoS service to do it for you, the FBI considers it a crime.”⁵

The middleman doesn’t give you legal cover. A $10 booter subscription puts you under the same statute that covers sophisticated hacking.

State Charges Can Stack on Top

Federal law isn’t the only exposure. At least 26 states have statutes that address denial-of-service attacks directly, and nearly every state criminalizes unauthorized access to computer systems more broadly.⁶ Some states grade the offense by dollar amount, treating smaller disruptions as misdemeanors and larger ones as felonies. Others treat any intentional disruption of computer services as a felony regardless of the loss figure.

A single attack can also trigger charges in more than one jurisdiction. If you’re in one state and the target is in another, both states may have authority to prosecute, and federal charges can run alongside state ones because the CFAA comes from a separate sovereign. First-offense state fines generally fall between $5,000 and $10,000, with felony-level offenses carrying significantly more.

The Victim Can Also Sue You

Criminal charges aren’t the only risk. The CFAA contains a private right of action: anyone who suffers damage or loss from a violation can sue the attacker for compensatory damages and injunctive relief. The suit has to involve at least $5,000 in loss, damage to 10 or more computers, a threat to public safety, physical injury, or impairment of medical care. For purely financial cases, recovery is capped at economic damages. The statute of limitations is two years from when the damage was discovered.²

Victims also have common-law options. The most useful is trespass to chattels, which courts have extended to electronic interference with computer systems. The plaintiff has to show that the defendant intentionally and without authorization interfered with the plaintiff’s system and that the interference caused actual harm.⁷ A business that was offline for hours can usually document lost revenue, emergency IT costs, and reputational damage that outstrips a criminal fine. Intentional interference with contractual relations is another angle when a DDoS attack prevents a company from meeting obligations to its customers.

Does Being a Minor Change Anything

A lot of booting happens in gaming communities, and plenty of the people doing it are teenagers. Being under 18 does not make it legal. Minors can be charged under the same federal statutes, usually through the juvenile justice system rather than adult court.

In federal juvenile proceedings, the focus is rehabilitation, and a juvenile found delinquent cannot be detained past their 21st birthday for conduct committed before 18. The Sentencing Guidelines don’t formally apply, though any sentence can’t exceed the maximum guideline range that would apply to a similarly situated adult. In serious cases, a juvenile can be transferred to adult court, where none of the Juvenile Delinquency Act’s protections apply.⁸

Parents are also exposed. Most states have parental responsibility laws that hold parents financially liable for property damage caused by willful acts of their minor children. Caps vary from roughly $3,500 to $25,000 or more, and they apply per incident. A separate negligent-supervision theory can get around the cap entirely if a parent knew what their child was doing and didn’t intervene. When the victim is a business that lost revenue during an outage, a civil judgment can easily run past any state cap.

The Narrow Case Where It Isn’t Illegal

The CFAA turns on whether conduct is “without authorization.” If a company hires you to stress-test its servers and you flood them with traffic to find the breaking point, that isn’t a crime because you have permission. The Department of Justice has told prosecutors to decline cases involving “good-faith security research,” meaning access to a computer solely for testing, investigating, or fixing a security flaw in a way designed to avoid harm.⁹

That carve-out is narrow. Research done to extort a company or to sell exploits doesn’t qualify, and the policy is a prosecutorial guideline, not a statutory safe harbor. Testing a network you don’t own without written authorization is still risky even if you believe the owner would consent. Verbal agreements have a way of evaporating when the servers go down.

If You’ve Been Booted Offline

The FBI’s Internet Crime Complaint Center is the primary federal reporting channel. The complaint form asks for your contact information, anything you know about the attacker (IP addresses, usernames, email addresses), and a description of what happened. IC3 doesn’t collect evidence directly, so preserve your own records.¹⁰

Useful evidence includes network traffic captures showing the malicious traffic, server and firewall logs from the time of the attack, screenshots of any messages from the attacker, and timestamps for when the disruption started and ended. Keep the originals in a secure location. If the losses are significant, consider contacting your local FBI field office and talking to a lawyer about a civil claim under the CFAA. The two-year clock on civil claims runs from the date you discover the damage, so there’s no benefit to waiting.

1
WIPO Lex. Computer Fraud and Abuse Act of 1986, 18 U.S.C. 1030, United States of America
2
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
3
Internet Crime Complaint Center (IC3). Booter and Stresser Services Increase the Scale and Frequency of Distributed Denial of Service Attacks
4
U.S. Department of Justice. Illinois Man Sentenced to 2 Years in Federal Prison for Operating Subscription-Based Computer Attack Service
5
U.S. Department of Justice. 2 Defendants Charged in U.S. Courts as Part of Global Crackdown on Booter Services
6
National Conference of State Legislatures. Computer Crime Statutes
7
Internet Law Treatise. Trespass to Chattels
8
U.S. Department of Justice. Principles of Federal Juvenile Prosecution
9
U.S. Department of Justice. 9-48.000 – Computer Fraud and Abuse Act
10
Internet Crime Complaint Center (IC3). Frequently Asked Questions