Unauthorized Access: Federal Statutes, Penalties, and Civil Claims

Accessing a computer, account, or network without permission is a federal crime under the Computer Fraud and Abuse Act and the Stored Communications Act, and unauthorized computer access laws and penalties range from up to one year in prison for a basic first offense to 20 years when the intrusion causes serious bodily injury. Victims can also sue for money damages and court orders, and every state has its own computer-crime statute that may apply on top of federal charges.

What Counts as Unauthorized Access

Federal law reaches two kinds of conduct. The first is accessing a computer you were never allowed to use, typically by bypassing a login screen, firewall, or encryption. The second is “exceeding authorized access”: using legitimate credentials to reach information you were not entitled to retrieve.¹ An employee allowed to see the company directory who uses the same credentials to pull confidential salary records has crossed that second line.

The statute reaches “protected computers,” which the law defines broadly enough to include any device used in interstate or foreign commerce or communication. In practice that covers smartphones, web servers, cloud platforms, and almost any internet-connected device.¹

The Van Buren Narrowing

In Van Buren v. United States (2021), the Supreme Court cut back what “exceeds authorized access” means. The Court adopted a “gates-up-or-down” test: either a person can reach certain files and folders through their normal access, or they cannot. Using permitted access for a disallowed purpose does not, on its own, violate the CFAA.²

That reasoning also shapes how courts treat website terms-of-service violations. Breaking a site’s usage rules generally is not unauthorized access unless the person also got past a technical barrier. A “no scraping” clause is not the same as a locked door.

Intent

Accidentally reaching a restricted area usually will not meet the threshold. The person must knowingly proceed past a clear restriction, and courts look at whether they had reason to know the access was off-limits and chose to continue anyway.

The Two Federal Statutes

The CFAA, 18 U.S.C. § 1030, is the main law for digital intrusions. It prohibits accessing a protected computer without authorization to obtain information, trafficking in passwords, transmitting damaging code, and extorting the owner of a protected computer, among other acts.¹

The Stored Communications Act, 18 U.S.C. Chapter 121, works alongside the CFAA and targets a different problem: the privacy of data held by service providers. The CFAA focuses on breaking into a system; the SCA protects the contents of emails, cloud files, and other electronic communications while they sit in storage. Accessing someone’s email account without permission, or compelling a provider to turn over private messages without proper legal authority, violates the SCA.³ A single case can trigger both: CFAA charges for the intrusion, SCA charges for the stored messages the intruder read.

Criminal Penalties

Sentences under both statutes escalate based on intent and harm.

CFAA Penalties

Basic unauthorized access, first offense: up to one year in prison and a fine of up to $100,000.⁴⁵
Access for financial gain or commercial advantage: up to five years and fines of up to $250,000 for individuals or $500,000 for organizations.¹⁵
Repeat offenders: up to ten years for a second or subsequent CFAA conviction.¹
Causing serious bodily injury: up to 20 years. This tier applies when an intrusion leads to physical harm, such as tampering with medical devices or industrial control systems.¹

SCA Penalties

The SCA’s tiers largely mirror the CFAA’s. Basic unauthorized access to stored communications on a first offense carries up to one year. Access for commercial advantage, private gain, or malicious destruction raises the first-offense ceiling to five years. Repeat offenders face up to five years for basic violations and up to ten with an aggravating motive.⁶

Forfeiture and Restitution

A CFAA conviction requires the court to order forfeiture of personal property used to commit the offense, including computers, servers, storage devices, and anything bought with proceeds of the crime.¹ Federal law also requires restitution to victims of certain property offenses, which can cover damage assessments, system restoration, lost revenue from interruptions, and related expenses. Restitution is part of the criminal sentence, not a separate collection action.⁷

Aggravated Identity Theft

When unauthorized access is used to steal someone’s identity, prosecutors often add a charge under 18 U.S.C. § 1028A. Aggravated identity theft carries a mandatory two-year prison sentence that runs consecutively, meaning it stacks on top of the sentence for the underlying computer crime and cannot overlap with it. For terrorism-connected offenses, the mandatory add-on is five years.⁸

Civil Lawsuits by Victims

Both statutes let victims sue in federal court.

CFAA Civil Claims

A CFAA plaintiff must show the violation caused at least $5,000 in combined losses over any one-year period. “Loss” is defined broadly: investigating the incident, assessing damage, restoring systems, and revenue lost during service interruptions all count. Attorney fees for the civil lawsuit itself generally do not count toward the threshold. If the plaintiff clears it, the court can award compensatory damages and injunctive relief that bars the defendant from further access.¹

The lawsuit must be filed within two years. The clock starts on the date of the unauthorized access or the date the victim discovered the resulting damage, whichever is later.¹

SCA Civil Claims

The SCA is friendlier to plaintiffs in several ways. There is no minimum dollar threshold. A court can award actual damages plus any profits the violator earned from the breach, with a guaranteed minimum of $1,000 even where actual damages are lower. Punitive damages are available for willful violations, and reasonable attorney fees are recoverable.⁹ For an individual whose email or cloud account was accessed without permission, the SCA is often the stronger vehicle.

Good-Faith Security Research

Security researchers who probe systems to find and report vulnerabilities sit in an awkward place under the CFAA. Department of Justice policy directs federal prosecutors to decline charges where the evidence shows good-faith security research: testing done to find and fix flaws, carried out in a way designed to avoid harm, with findings used to improve security for users of the affected systems. Research that falls outside those criteria, such as finding a vulnerability and then extorting the owner, gets no protection.¹⁰ The policy is prosecutorial, not statutory, so it does not block a civil lawsuit from the system owner.

State Computer Crime Laws

All 50 states, plus Puerto Rico and the U.S. Virgin Islands, have their own computer-crime statutes. Most address unauthorized access or computer trespass in terms similar to the CFAA, but penalties, definitions, and thresholds vary. Some states treat basic unauthorized access as a misdemeanor; others charge first offenses as felonies when sensitive personal data is involved. State and federal charges can proceed in parallel, and state law is often the easier route when the $5,000 CFAA threshold is in doubt, such as a former employee who copied files on the way out the door.

Notification Duties After a Breach

If your organization suffers unauthorized access, reporting the crime and considering a lawsuit are not the end of your obligations. The FTC’s Health Breach Notification Rule requires companies that hold personal health records outside the HIPAA framework, such as health apps and fitness trackers, to notify affected individuals and the FTC, and in some cases prominent media outlets, when a breach involves 500 or more residents of a single state.¹¹ Every state also has its own breach-notification law with its own triggers and timelines. Failing to notify can create separate penalties on top of the liability from the breach itself.

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
2
Supreme Court of the United States. Van Buren v. United States, 593 U.S. 374 (2021)
3
Office of the Law Revision Counsel. 18 USC Chapter 121 – Stored Wire and Electronic Communications and Transactional Records Access
4
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
5
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
6
Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
7
Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes
8
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
9
Office of the Law Revision Counsel. 18 USC 2707 – Civil Action
10
U.S. Department of Justice. Computer Fraud and Abuse Act (JM 9-48.000)
11
eCFR. Health Breach Notification Rule (16 CFR Part 318)