Punishment for DDoSing: Fines, Prison Time, and CFAA Charges

The punishment for DDoSing someone in the United States can reach ten years in federal prison on a first offense, along with fines up to $250,000, a court order to repay the victim, and forfeiture of the computers and money tied to the attack. The main law is the federal Computer Fraud and Abuse Act, and it reaches well beyond the person at the keyboard: hiring a “booter” service, conspiring with others, or even attempting an attack all carry the same penalty range as pulling it off. Victims can also sue separately for every dollar they lost.

Federal Prison Time Under the CFAA

The Computer Fraud and Abuse Act, at 18 U.S.C. § 1030, makes it a crime to knowingly transmit a program, code, or command that intentionally damages a “protected computer” without authorization.¹ The definition of “protected computer” covers essentially any machine connected to the internet, because it includes any computer “used in or affecting interstate or foreign commerce or communication,” along with government, financial institution, and voting systems.

How much prison time a defendant faces depends on what the attack did:

Up to 1 year for a DDoS offense under subsection (a)(5) that does not meet any of the harm thresholds below.
Up to 5 years for a first offense that causes at least $5,000 in aggregate losses within a single year, or that meets other qualifying factors like threatening public health or safety.
Up to 10 years for a first offense involving intentional damage charged under subsection (a)(5)(A) where the $5,000 or other harm thresholds are met.
Up to 20 years for a repeat conviction, or for an attack that causes or attempts to cause serious bodily injury.
Up to life in prison for an attack that causes or attempts to cause someone’s death.

The last tier is not hypothetical window dressing. A DDoS aimed at a hospital network or an emergency dispatch system can realistically put lives at risk.¹

The $5,000 Threshold That Unlocks Felony Exposure

A DDoS attack does not automatically produce felony-level punishment. The five-year and ten-year maximums apply only when the government can show the offense caused at least $5,000 in losses across all victims during a one-year period.¹ Below that, the maximum drops to one year.

In practice, that bar is easy to clear. Loss under the CFAA covers lost revenue, the cost of investigating the attack, system restoration, and any remediation work. For a business of real size, even a few hours of downtime plus incident-response fees will blow past $5,000 quickly. The threshold mostly matters when the target is a personal website or a small hobby server.

Fines, Restitution, and Forfeiture

Prison is only part of the bill. Federal fines for an individual convicted of a felony reach $250,000, or $100,000 for a Class A misdemeanor.² If an organization is convicted, those caps double to $500,000 and $200,000. A court can also impose a fine equal to twice the defendant’s gain or twice the victim’s loss, whichever is greater, if that number exceeds the standard cap.

On top of the fine, courts routinely order restitution: direct repayment to the victim for the cost of responding to and recovering from the attack. In one 2020 case, a man who used booter services to DDoS a legal news aggregator received the statutory maximum of five years and was ordered to pay more than $520,000 in restitution.³

Forfeiture adds another layer. On conviction, the court must order the defendant to hand over any personal property used to carry out the attack and any proceeds derived from it.⁴ Computers, servers, cryptocurrency wallets, and money earned through DDoS-for-hire operations can all be seized. Forfeiture also applies to anyone convicted of conspiracy to violate the CFAA, not just the person who executed the attack.

Hiring a Booter Service Carries the Same Penalty

You do not need to personally flood a server to face the full weight of the CFAA. The statute treats conspiracy and attempts at the same penalty level as the completed offense.¹ That is what makes “booter” and “stresser” services so dangerous for the operators, the customers, and anyone who helps run the infrastructure.

Federal law enforcement has prioritized these services. Through Operation PowerOFF, the Department of Justice has seized more than 75 domains tied to DDoS-for-hire platforms, with nine more taken down in May 2025, and more than 11 defendants have been charged in federal courts over a four-year span.⁵ Paying someone else to launch the attack does not insulate the customer from prosecution, and overseas operation is not a shield either; the May 2025 action was coordinated with Poland’s Central Cybercrime Bureau, which simultaneously arrested four booter administrators.

What Actually Drives the Sentence a Judge Imposes

Statutory maximums are the ceiling. The sentence a federal judge actually hands down comes from the U.S. Sentencing Commission’s guidelines, and DDoS offenses fall under Guideline Section 2B1.1.

The dollar amount of loss is the biggest driver. The guidelines use a tiered table: losses above $6,500 add 2 levels, losses above $95,000 add 8 levels, losses above $1.5 million add 16 levels, and the scale climbs through losses exceeding $550 million for a 30-level increase.⁶ Each level translates into meaningfully more prison time.

The target matters independently of the dollar amount. If the offense involved a system used to maintain critical infrastructure, or one used by a government entity for national defense or the administration of justice, the offense level goes up further.⁶ Hitting a hospital network is treated as categorically more serious than hitting a gaming server even when the raw financial losses are similar.

Motive and sophistication also move the number. An attacker extorting a business by threatening repeated attacks faces harsher treatment than someone acting on a grudge or curiosity. A coordinated campaign using custom botnets signals more planning than a teenager paying $20 for a booter subscription. Prior criminal history can double the statutory maximum for a qualifying CFAA offense from 10 years to 20.

State Charges on Top of Federal

Federal charges are not the only risk. All 50 states, Puerto Rico, and the U.S. Virgin Islands have their own computer crime statutes, most of which target unauthorized access, system interference, or damage to computer data.⁷ That conduct maps directly onto a DDoS attack.

State penalties range widely. A minor attack might be a misdemeanor with up to a year in jail and moderate fines. More serious offenses, especially those causing substantial financial damage or targeting sensitive systems, can be charged as felonies with multi-year prison sentences and much larger fines. State and federal prosecutors can charge the same conduct independently, so a single DDoS can produce two separate criminal cases.

Getting Sued by the Victim

Criminal prosecution is the government’s tool. Victims have their own: the CFAA expressly lets anyone who suffers damage or loss from a violation sue for compensatory damages and injunctive relief.¹ The civil suit is independent of any criminal case and can proceed whether or not prosecutors file charges.

Compensatory damages cover the full range of provable harm: lost revenue during the outage, emergency incident-response costs, expenses for rebuilding or hardening systems, and related losses like cancelled contracts or customer churn. For an e-commerce or financial services company, even a few hours offline can translate into six- or seven-figure losses. A court can also issue injunctive relief, ordering the attacker to stop, take down infrastructure, or stay away from the victim’s systems.

One limit: the civil claim is available only if the attack involved one of the specific harm factors listed in the statute, such as aggregate losses of at least $5,000, a threat to public health or safety, damage to a government computer, or damage affecting ten or more protected computers in a one-year period. Any attack of real scale will meet at least one; a trivially small DDoS against a personal blog may not.

Deadlines for Charges and Lawsuits

Prosecutors have five years from the date of the offense to bring federal charges. That is the general federal statute of limitations, and because the CFAA sets no different period, the five-year default applies.⁸ Digital forensics can be slow, especially when tracing attacks through proxies and across borders, so that window gives agents real time to build a case.

Civil suits run on a tighter clock. A victim must file within two years of either the date of the attack or the date the damage was discovered, whichever is later.⁴ The discovery rule helps when damage is not immediately apparent, but two years is still short.

If the Person Charged Is a Minor

Many DDoS prosecutions involve teenagers, especially those who buy booter services without grasping the exposure. When the defendant is a minor, the case usually goes through the juvenile justice system rather than adult criminal court, with outcomes focused on rehabilitation: community supervision, probation, mandatory educational programs, and in serious cases, placement in a juvenile facility.

Minors are not off the hook financially. Courts can order a minor or the parents to pay restitution covering the victim’s property damage and related expenses. In cases involving particularly large-scale attacks or older teenagers, federal prosecutors can seek to transfer the case to adult court, which opens the door to the full CFAA penalty structure above. Being 16 does not automatically prevent serious consequences.

1
Office of the Law Revision Counsel. 18 USC 1030 Fraud and Related Activity in Connection With Computers
2
Office of the Law Revision Counsel. 18 US Code 3571 – Sentence of Fine
3
United States Department of Justice. Man Receives Maximum Sentence for DDoS Attack on Legal News Aggregator
4
Office of the Law Revision Counsel. 18 US Code 1030 – Fraud and Related Activity in Connection With Computers
5
United States Department of Justice. Law Enforcement Seizes 9 DDoS-for-Hire Webpages as Part of Global Crackdown on Booter and Stresser Services
6
United States Sentencing Commission. USSC Guidelines 2B1.1
7
National Conference of State Legislatures. Computer Crime Statutes
8
Office of the Law Revision Counsel. 18 US Code 3282 – Offenses Not Capital