Unauthorized Access to a Computer System: Penalties and Lawsuits

Unauthorized access to a computer system is a federal crime under the Computer Fraud and Abuse Act, with prison sentences running up to one year for a basic first offense and as high as 20 years for repeat national-security violations. Every state has its own computer crime statute on top of that, mandatory forfeiture applies after conviction, and the victim can sue you civilly whether or not prosecutors file charges.

What the Law Treats as Unauthorized Access

Federal law splits unauthorized access into two shapes. The first is accessing a system you have no permission to use at all, like logging in with a stolen or guessed password. The second is subtler: you have legitimate access but reach into areas that are off-limits to your role. The statute phrases this second form as using access “to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.”¹

The line between those two forms and ordinary misuse is where cases turn. In Van Buren v. United States, the Supreme Court held that the CFAA “covers those who obtain information from particular areas in the computer—such as files, folders, or databases—to which their computer access does not extend” but “does not cover those who…have improper motives for obtaining information that is otherwise available to them.”² So an employee who browses files their role doesn’t authorize them to see has exceeded authorized access. An employee who looks up records they are allowed to see and then uses them for a bad reason has not committed a federal crime, however wrong the motive.

The same decision pulled website terms of service out of the CFAA’s reach. The Court observed that treating any use restriction as a federal crime would “criminalize everything from embellishing an online-dating profile to using a pseudonym on Facebook.”² Breaking a platform’s rules may get your account closed, but it isn’t a federal offense.

The “computer” the statute protects is not limited to desktops and laptops. A protected computer includes any system used by a financial institution or the federal government, any computer that is part of a federal election voting system, and, most broadly, any computer “used in or affecting interstate or foreign commerce or communication.”¹ That last category sweeps in essentially every internet-connected device: phones, tablets, cloud accounts, servers, networked home devices. If it reaches the internet, federal law almost certainly reaches it.

Federal Prison Penalties

Penalties under the CFAA, codified at 18 U.S.C. § 1030, climb based on what the offender did, what they were after, and whether they have prior convictions.¹ The statute has existed since 1986 and has been amended repeatedly to expand both the definition of a protected computer and the conduct it covers.

First Offense

A simple unauthorized-access conviction—getting in and obtaining information with no aggravating factors—carries up to one year in prison. Trafficking in passwords without aggravating factors falls in the same tier. Accessing a protected computer to defraud and obtain something of value, or threatening damage to a computer to extort money, carries up to five years for a first offense. Obtaining classified or restricted national-defense data carries up to ten years.¹

Transmitting damaging code—malware, viruses, ransomware payloads, or any command meant to impair a system—and extortion threats sit in their own category, with penalties that scale with the harm caused.

Repeat Offenses

A second CFAA conviction roughly doubles each maximum. Simple unauthorized access goes from one year to ten. Fraud and extortion go from five years to ten. National-security violations go from ten years to twenty.¹ The enhancement applies whenever the new offense occurs after any prior conviction under section 1030, so even a prior misdemeanor can push a later charge into the enhanced range.

When a Misdemeanor Becomes a Felony

Basic unauthorized access starts as a misdemeanor. It becomes a felony when the access was committed to further another crime or tortious act, when the purpose was commercial advantage or private financial gain, or when the value of what was obtained exceeds $5,000. This is where seemingly small intrusions escalate. Pulling a former employer’s customer list to use at a new job, for example, can clear the $5,000 value threshold on its own and turn a minor trespass into multi-year felony exposure.

Forfeiture After Conviction

A CFAA conviction triggers mandatory forfeiture on top of any prison term or fine. The court must order the convicted person to surrender any personal property used to commit or facilitate the offense—computers, phones, storage devices, networking gear—and any proceeds obtained from the crime, whether in money or in property, directly or indirectly.¹ The statute states plainly that no property right exists in items used for or derived from a violation. If someone hacks a system and sells the stolen data, both the sale proceeds and the equipment used for the breach are subject to seizure.

Civil Lawsuits by Victims

Prison isn’t the only financial risk. The CFAA gives victims a private right to sue the person who accessed their systems, seeking compensatory damages and injunctive relief that can force the offender to stop and to return or destroy stolen data.¹ A victim can file suit whether or not prosecutors ever bring criminal charges.

Not every incident qualifies. The conduct has to involve at least one of five factors:

Financial loss aggregating to at least $5,000 to one or more victims in any one-year period.
Actual or potential modification or impairment of someone’s medical examination, diagnosis, or treatment.
Physical injury to a person.
A threat to public health or safety.
Damage to a computer used in furtherance of justice administration, national defense, or national security.¹

The $5,000 threshold is the most commonly litigated. “Loss” is defined broadly to include the cost of responding to the breach, assessing the damage, restoring the data and systems, lost revenue, and other consequential damages from service interruptions.¹ Incident response, forensics, system restoration, and lost business add up quickly, and even a modest intrusion often clears the threshold.

Suits must be filed within two years of the unauthorized access or within two years of discovering the damage, whichever is later.¹ The discovery rule matters because intrusions often go unnoticed for months. When the only qualifying factor is the $5,000 loss, recovery is limited to economic harm. The Supreme Court reinforced in Van Buren that the statute’s definitions of “damage” and “loss” focus on technological harms—corrupted files, impaired systems, outages—rather than the misuse of information someone was already permitted to access.² You also cannot sue under the CFAA for the negligent design or manufacture of hardware or software, even if a security flaw enabled the breach.

State Computer Crime Charges

Federal exposure isn’t the whole picture. Every state, along with Puerto Rico and the U.S. Virgin Islands, has enacted its own computer crime statutes, and prosecutors can bring charges under federal law, state law, or both for the same conduct.³

State laws vary in how they define unauthorized access, what thresholds trigger felony treatment, and which conduct they single out. At least 12 states now have statutes that expressly address ransomware or computer extortion as standalone offenses rather than folding them into general unauthorized-access prohibitions.³ Several states also bar government agencies from paying ransom demands or require public entities to report ransomware incidents. Maximum fines for a first-offense misdemeanor conviction of unauthorized access at the state level typically run from $500 to $4,000, though the range is wide.

Good-Faith Security Research

Security researchers who probe systems for vulnerabilities often operate near the line. In May 2022, the Department of Justice issued a policy directing federal prosecutors not to bring CFAA charges against people conducting good-faith security research. The DOJ defines that as accessing a computer solely to test, investigate, or correct a security flaw, where the researcher takes steps to avoid harm and uses the findings primarily to improve the security of the affected devices or services.⁴ “Solely” does the work in that definition: someone who finds a vulnerability and then uses it to extort the company, steal data, or cause damage is outside the carve-out, whatever the activity is called. The policy also binds only federal prosecutors, so a researcher protected from federal charges can still face state computer crime charges for the same conduct.

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
2
Supreme Court of the United States. Van Buren v. United States
3
National Conference of State Legislatures. Computer Crime Statutes
4
United States Department of Justice. Department of Justice Announces New Policy for Charging Cases Under Computer Fraud and Abuse Act