Is It Illegal to Hire a Hacker? Charges and Penalties

Yes, it is illegal to hire a hacker in the United States. Paying someone to break into a computer, email account, phone, or network is a federal crime, and under federal law the person who hires the hacker faces the same charges and the same maximum prison sentence as the person who carries out the intrusion. Multiple statutes can apply to a single transaction, fines reach $250,000 per count, and the victim can sue you on top of whatever the government does.

Why Paying Someone Else Doesn’t Shield You

Hiring out the work does not create a legal buffer. Federal law closes that gap from two directions.

Under 18 U.S.C. § 2, anyone who commands, induces, or procures another person to commit a federal offense is punishable as a principal.¹ If you pay a hacker to break into a system, the law treats you as if you did the hacking yourself.

Making the deal also creates a separate conspiracy charge. Under 18 U.S.C. § 371, agreeing with another person to commit a federal crime is itself a crime carrying up to five years in prison, as long as either party takes any step to carry out the plan.² Sending payment, sharing the target’s information, or setting up a meeting all qualify as overt acts. The hack does not need to succeed. The agreement plus any step toward it is enough.

The Computer Fraud and Abuse Act reinforces this by separately criminalizing conspiracy and attempt to commit any of its offenses, with penalties matching the underlying crime.³ A single act of hiring can generate charges under the aiding and abetting statute, the general conspiracy statute, and the CFAA’s own conspiracy provision at the same time.

The Federal Laws That Apply

Depending on exactly what the hired hacker does, different statutes attach. Most hiring cases trigger more than one.

The Computer Fraud and Abuse Act

The main federal hacking law is the CFAA, at 18 U.S.C. § 1030. It makes it a crime to intentionally access a “protected computer” without authorization. The definition is broad enough to cover nearly any device connected to the internet, including personal laptops, company servers, and cloud email providers.³ It covers accessing a computer to obtain information, computer fraud for financial gain, intentionally damaging a system, trafficking in passwords, and extortion involving computers.

The Wiretap Act

If the hack involves intercepting communications in real time (reading emails as they are sent, monitoring text messages, listening to calls) the federal Wiretap Act at 18 U.S.C. § 2511 applies. The statute specifically targets anyone who intercepts electronic communications or “procures any other person” to do so.⁴ That “procures” language was written with the hiring scenario in mind. A first offense carries up to five years in prison.

The Stored Communications Act

Breaking into an email inbox, cloud storage, or social media account targets communications already sitting on a server, which falls under the Stored Communications Act at 18 U.S.C. § 2701. A first offense committed for commercial advantage or private financial gain carries up to five years. Without a profit motive it is still a crime, punishable by up to one year.⁵ This is the law most commonly triggered when someone pays a hacker to get into an ex-partner’s or business rival’s accounts.

Aggravated Identity Theft

If the hack involves using someone else’s login credentials, which it almost always does, a charge under 18 U.S.C. § 1028A can follow. Aggravated identity theft carries a mandatory two-year prison sentence that runs consecutively, meaning it is added on top of whatever other sentence the court imposes.⁶ There is no parole for that addition, and the court cannot reduce it below the mandatory minimum. Prosecutors use it as leverage for that reason.

Prison Time and Fines

Sentencing under the CFAA depends on what the hacker was hired to do and whether the defendant has a prior CFAA conviction. The ceilings:

Accessing a computer to obtain information: up to one year for a first offense, rising to five years if the offense was committed for financial gain, to further another crime, or if the information obtained was worth more than $5,000. A second conviction raises the ceiling to ten years.³
Computer fraud for financial gain: up to five years for a first offense, ten for a second.
Intentionally damaging a computer: up to ten years for a first offense, twenty for a second.
Obtaining national security information: up to ten years, doubling to twenty for a repeat offense.
Extortion involving computers: up to five years for a first offense, ten for a second.

The CFAA refers to “a fine under this title” without stating a dollar figure. The cap comes from 18 U.S.C. § 3571, which sets the maximum fine at $250,000 for any federal felony and $100,000 for a Class A misdemeanor.⁷ These amounts apply per count, so multiple charges multiply the exposure quickly. Add the five-year ceiling from the § 371 conspiracy charge, and a single transaction can carry a decade or more of combined prison exposure before any Wiretap Act or Stored Communications Act counts are layered on.

You Can Also Be Sued

Criminal prosecution is not the only financial risk. The CFAA gives the victim a private right to sue under § 1030(g), including suing the person who hired the hacker. The lawsuit must be filed within two years of the act or the date the victim discovered the damage.³

Civil damages add up faster than most people expect. The victim can recover the cost of investigating the breach, hiring forensic consultants, restoring data, rebuilding compromised systems, and lost business revenue during the recovery. A breach affecting a small business can easily generate tens of thousands of dollars in documented losses. Larger organizations can claim far more.

On the criminal side, courts can also order mandatory restitution under 18 U.S.C. § 3663A. This requires the defendant to pay for the victim’s actual property losses, including expenses incurred during the investigation and prosecution.⁸ Unlike fines paid to the government, restitution goes directly to the victim and is not dischargeable in bankruptcy.

Situations People Wrongly Think Are Okay

Most people asking this question are not thinking about corporate espionage. They are thinking about more personal situations. The law does not treat those any differently.

Hiring someone to access a spouse’s or partner’s email, phone, or social media violates the CFAA and the Stored Communications Act. If the hacker intercepts messages in real time, the Wiretap Act applies too. Courts have consistently rejected the argument that marriage creates implied authorization to access a partner’s private accounts.
Paying someone to install spyware or a keylogger on another person’s device triggers the Wiretap Act’s prohibition on intercepting communications, which explicitly covers procuring someone else to do the intercepting.⁴
Paying a hacker to get into a competitor’s systems exposes you to CFAA charges, potential Economic Espionage Act charges, and civil lawsuits that could include the full cost of the competitor’s forensic investigation.
Hiring someone to retrieve data you consider “your own” from a computer you do not control is still unauthorized access if the owner has not given you permission. The correct route is a court order or subpoena.

The common thread: your reason for wanting the information is legally irrelevant. Courts look at whether the access was authorized, not whether the person hiring the hacker felt justified.

When Hiring Hacking Skills Is Legal

There is a legal version of this, and it matters for anyone trying to secure their own systems. Penetration testers and security consultants are hired to probe computer systems for vulnerabilities, and they work with the explicit written consent of the system owner. The point is to find weaknesses before a criminal does.

Ethical hackers operate under detailed contracts defining which systems can be tested, what methods are allowed, and how long the engagement lasts. Going outside that scope would turn a legal engagement into an illegal one. Professionals typically hold certifications such as the Certified Ethical Hacker (CEH), the Offensive Security Certified Professional (OSCP), or the GIAC Penetration Tester (GPEN). If you need someone to test your own systems, look for those credentials. The difference between a legal engagement and a federal crime is authorization in writing from the owner of every system being touched.

If You’ve Been Hacked, Don’t Hire Back

If someone has broken into your accounts or systems, the instinct to retaliate or hire someone to hack back is understandable but illegal. Retaliatory hacking exposes you to every charge described above, regardless of what was done to you first.

The Department of Justice recommends reporting computer intrusions to the FBI through your local field office or the Internet Crime Complaint Center (IC3).⁹ The U.S. Secret Service also investigates cybercrimes involving financial systems. Change your passwords immediately, enable multi-factor authentication, and preserve any evidence of the intrusion before contacting law enforcement. Filing a report creates a paper trail that supports both criminal prosecution of the attacker and any civil lawsuit you pursue later.

1
Office of the Law Revision Counsel. 18 USC 2 – Principals
2
Office of the Law Revision Counsel. 18 USC 371 – Conspiracy to Commit Offense or to Defraud United States
3
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
4
Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited
5
Office of the Law Revision Counsel. 18 U.S. Code 2701 – Unlawful Access to Stored Communications
6
Office of the Law Revision Counsel. 18 U.S. Code 1028A – Aggravated Identity Theft
7
Office of the Law Revision Counsel. 18 U.S. Code 3571 – Sentence of Fine
8
Office of the Law Revision Counsel. 18 U.S. Code 3663A – Mandatory Restitution to Victims of Certain Crimes
9
U.S. Department of Justice. Reporting Computer, Internet-Related, or Intellectual Property Crime