Is It Illegal to DDoS? Fines, Prison Time, and Lawsuits

Yes, it is illegal to DDoS someone else’s system. Launching a Distributed Denial-of-Service attack is a federal crime under the Computer Fraud and Abuse Act, carrying up to 10 years in prison for a first offense and up to 20 years for a repeat conviction, plus fines of up to $250,000 for an individual.¹ The prohibition reaches the person who runs the attack and anyone who pays a DDoS-for-hire service to do it for them. Victims can also sue in civil court to recover their losses.

What the Law Prohibits

The main statute is the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. It is a crime to knowingly transmit a program, code, or command that intentionally causes damage to a “protected computer” without authorization.² A DDoS attack fits that language directly, because the whole purpose is to impair a system’s availability by flooding it with junk traffic.

Two definitions do most of the work. “Protected computer” covers virtually any internet-connected device, since the computer only needs to be “used in or affecting interstate or foreign commerce or communication” to qualify.² That takes in commercial sites, cloud servers, gaming platforms, and personal devices. “Damage” means any impairment to the integrity or availability of data, a program, a system, or information. Nothing has to be deleted or physically broken. Making a website unreachable is enough.

To bring a charge, prosecutors also have to show the attack caused one of a short list of qualifying harms: at least $5,000 in aggregate losses over a one-year period, physical injury, a threat to public health or safety, damage to a government computer used for justice or national security, or damage affecting 10 or more protected computers in a year.² The $5,000 threshold sounds low, and in practice it is. Incident response, lost revenue during downtime, and the cost of restoring service add up quickly.

Prison Time and Fines

The CFAA uses tiered penalties. Which tier applies depends on the attacker’s state of mind, whether it is a first or repeat offense, and whether anyone was physically harmed.

Intentional damage, first offense: up to 10 years in prison. This is the standard charge for a deliberate DDoS attack. Prosecutors have to show the attacker knowingly transmitted code or commands designed to cause damage.²
Reckless damage, first offense: up to 5 years. This covers unauthorized access that recklessly caused damage even when disruption was not the primary goal.²
Repeat offense: up to 20 years. A prior CFAA conviction doubles the maximum.²
Serious bodily injury: up to 20 years, even on a first offense. If an attack disrupts a hospital or emergency service and someone is physically hurt, this enhancement applies.
Death: life imprisonment, with no statutory cap.²

Fines come from the general federal sentencing statute, 18 U.S.C. § 3571. An individual convicted of a felony faces up to $250,000; an organization faces up to $500,000.³ Federal sentencing guidelines add further enhancements when the target is critical infrastructure, which pushes the recommended range higher.⁴

Paying for a Booter or Stresser Is Also Illegal

A common misconception is that only the person building the botnet is breaking the law. Paying for a DDoS-for-hire service, usually marketed as a “booter” or “stresser,” is just as illegal. The FBI has stated this plainly: transmitting a program or command to a protected computer is illegal regardless of whether you use your own infrastructure or hire someone else to do it for you.¹

Federal authorities have gone after the supply side aggressively. Under Operation PowerOFF, the Department of Justice seized 13 internet domains tied to DDoS-for-hire platforms and secured guilty pleas from four defendants who operated or helped run booter websites.⁵ In one case, an Illinois man who ran two DDoS facilitation sites received a two-year federal prison sentence after a jury convicted him of conspiracy to impair protected computers and conspiracy to commit wire fraud. One of his customers, who later became a co-administrator of the site, pleaded guilty and received five years of probation.⁶ Buyers, operators, and administrators all face CFAA charges.

Victims Can Sue You in Civil Court

Criminal prosecution is only part of the exposure. The CFAA also gives victims the right to file their own civil lawsuit against anyone who violates the statute. A successful plaintiff can recover compensatory damages and get a court order stopping the conduct.² “Loss” is defined broadly: the cost of responding to the attack, assessing damage, restoring systems, and revenue lost while services were down.

The civil deadline is two years from the attack or two years from the date the victim discovered the damage, whichever is later.² Attribution can take time, so that clock often starts well after the attack itself. On the criminal side, the general federal five-year statute of limitations gives prosecutors a longer window to identify suspects and build a case.

State Charges Can Apply Too

Federal law is not the only source of liability. At least 26 states have enacted laws that specifically address denial-of-service attacks, and most other states have broader computer crime statutes that prosecutors can apply. These laws generally prohibit unauthorized access and the intentional disruption of computer services, mirroring the CFAA’s core prohibitions. Penalties vary widely by state, from misdemeanors for minor disruptions to felonies for attacks causing significant financial harm.

State prosecution matters because not every attack draws federal attention. If the dollar losses are relatively small or the harm is localized, a state prosecutor may handle it. Having both layers of enforcement means an attacker cannot count on slipping through because the FBI has bigger targets.

Testing Your Own Systems Is a Different Question

Authorization is the dividing line. The CFAA only prohibits damage caused “without authorization.” If you own the server, or have explicit written permission from the owner, sending heavy traffic to test resilience is not a CFAA violation.

The Department of Justice has formalized this in its charging policy. Federal prosecutors are directed to decline prosecution when the evidence shows the defendant’s conduct consisted of good-faith security research, meaning access solely for the purpose of testing, investigating, or correcting a security flaw, in a way designed to avoid harm to individuals or the public.⁷ The qualifiers that matter are “good faith” and “designed to avoid harm.” Stress-testing your own infrastructure to find weaknesses qualifies. Using a booter service against a competitor and calling it research does not.

A few practical guardrails keep legitimate testing on the right side of the law. Test only systems you own or have written authorization to test. Keep the testing within the scope of that authorization. Document your purpose and methodology before you start. If you are testing someone else’s system under a bug bounty or penetration testing agreement, get the scope in writing and stay inside it.

Attacks That Cross Borders

The CFAA reaches attacks on protected computers “located outside the United States” when the attack affects interstate or foreign commerce within the U.S., so federal prosecutors can charge foreign nationals who target American servers.² Actually getting a foreign suspect into a U.S. courtroom is a separate problem that depends on extradition treaties.

The United Nations Convention against Cybercrime, adopted recently, sets up a framework under which signatory states agree to treat covered offenses as extraditable and to cooperate in investigations.⁸ Extradition typically requires dual criminality, meaning the conduct is illegal in both countries. Most developed nations have their own computer crime laws, so DDoS cases clear that hurdle more easily than some other offenses. If a suspect sits in a country with no extradition treaty and no interest in cooperating, enforcement becomes very difficult regardless of what the statute says.

1
Federal Bureau of Investigation. The FBI and International Law Enforcement Partners Intensify Efforts to Combat Illegal DDoS Attacks
2
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
3
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
4
United States Sentencing Commission. Cyber Technology in Federal Crime
5
Department of Justice. Federal Authorities Seize 13 Internet Domains Associated with Booter Websites Offered DDoS Services
6
Department of Justice. Illinois Man Sentenced to 2 Years in Federal Prison for Operating Subscription-Based Computer Attack Platform
7
Department of Justice. JM 9-48.000 – Computer Fraud and Abuse Act
8
United Nations Office on Drugs and Crime. United Nations Convention Against Cybercrime