The legal penalties for ARP spoofing run from a one-year misdemeanor to a twenty-year felony, and a single attack typically violates several federal statutes at once. The Computer Fraud and Abuse Act, the Wiretap Act, and the Stored Communications Act each cover a different piece of what the attack does, and prosecutors can charge them together. If the attacker captured someone’s identifying information, a mandatory two-year sentence stacks on top. Victims can also sue in civil court for damages, attorney’s fees, and injunctions.
Here is how the exposure breaks down.
Computer Fraud and Abuse Act Penalties
The CFAA, at 18 U.S.C. 1030, is the main federal statute reached by an ARP spoofing attack. It criminalizes intentionally accessing a computer without authorization, or exceeding authorized access, to obtain information, commit fraud, or cause damage. Hijacking network traffic on systems the attacker has no right to control fits the statute directly.
The CFAA applies to “protected computers,” which the statute defines to include financial institution systems, federal government systems, voting systems, and any computer “used in or affecting interstate or foreign commerce or communication.”1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers In practice, that last category sweeps in nearly any internet-connected device.
Sentencing ranges depend on what the attacker did:
- Unauthorized access to obtain information carries up to one year for a first offense. The ceiling rises to five years if the offense was for commercial advantage, in furtherance of another crime, or if the information taken exceeds $5,000 in value. A second conviction can reach ten years.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
- Accessing a protected computer with intent to defraud and obtaining something of value carries up to five years for a first offense and ten years for a repeat offense.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
- Knowingly transmitting code or commands that damage a protected computer carries up to five years when total losses reach $5,000 within a one-year period, and up to ten years for subsequent offenses.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
- Unauthorized access to nonpublic federal government systems carries up to ten years for a first offense and twenty years for repeat offenders.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
The $5,000 loss threshold is easier to clear than it sounds. Loss under the CFAA includes the cost of investigating the breach, assessing damage, restoring systems, and any lost revenue from service interruptions.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers A business that pulls IT staff off their normal duties and brings in outside forensics will cross that line almost immediately.
Wiretap Act Penalties for Intercepted Traffic
ARP spoofing puts the attacker in a man-in-the-middle position, which is the whole point of the technique. Reading other people’s traffic in real time is the kind of conduct the federal Wiretap Act, 18 U.S.C. 2511, was written to reach. The statute prohibits the intentional interception of electronic communications without authorization, and a first offense is punishable by up to five years in prison and a fine.2Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Each packet of intercepted data is a separate act of interception, giving prosecutors wide discretion over how to charge.
Stored Communications Act Penalties
If the attack reaches stored data rather than only traffic in transit (emails on a server, cached files, and the like), the Stored Communications Act at 18 U.S.C. 2701 applies. Penalties turn on purpose:
- If the access was for commercial advantage, malicious damage, or to further another crime: up to five years for a first offense and ten years for a subsequent offense.3Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
- In all other cases: up to one year for a first offense and five years for a subsequent offense.3Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
ARP spoofing done to steal data or credentials almost always falls into the higher tier because the conduct furthers additional criminal activity.
The Mandatory Add-On for Aggravated Identity Theft
ARP spoofing is often used to grab login credentials, credit card numbers, or other personal information as it crosses the network. When someone captures and uses another person’s identifying information during the commission of certain listed felonies, 18 U.S.C. 1028A adds a mandatory two-year prison sentence on top of everything else. That sentence runs consecutively, meaning it cannot overlap with the underlying sentence. For terrorism-related identity theft, the mandatory add-on is five years.4Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
The predicate felonies include wire fraud, bank fraud, and computer fraud under the CFAA. An attack that captures credentials and uses them to access bank accounts can stack a CFAA charge with aggravated identity theft, turning a five-year maximum into seven years or more.
Civil Lawsuits by Victims
Criminal prosecution is not the only exposure. Both the CFAA and the Wiretap Act give victims the right to sue.
Under the CFAA, anyone who suffers damage or loss can sue for compensatory damages and injunctive relief, with a two-year window from the act or from discovery of the damage.5Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers For claims based solely on financial loss, damages are capped at economic losses, which still includes investigation costs, system restoration, and lost business revenue.
Under 18 U.S.C. 2520, Wiretap Act victims can recover the greater of actual damages plus the violator’s profits, or statutory damages of $100 per day of violation or $10,000, whichever is higher. Courts can also award punitive damages and reasonable attorney’s fees.6Office of the Law Revision Counsel. 18 USC 2520 – Recovery of Civil Damages Authorized For a business subjected to weeks of ARP spoofing, the statutory damages alone can add up before actual harm is calculated.
State Charges on Top of Federal
All 50 states, Puerto Rico, and the U.S. Virgin Islands have their own computer crime statutes, most covering unauthorized access or computer trespass.7National Conference of State Legislatures. Computer Crime Statutes Penalty ranges vary, but many states treat unauthorized network access as a felony when it involves financial gain or significant damage. Double jeopardy does not prevent state and federal authorities from prosecuting the same conduct separately, so a single attack can produce charges in two sovereigns.
When Authorized Security Testing Is Not a Crime
Network security professionals use ARP spoofing tools during penetration tests and audits, and the statutes above do not criminalize that work when it is properly authorized. The difference between a felony and a workday is written authorization.
In 2022, the Department of Justice revised its CFAA charging policy to state that prosecutors should decline prosecution for good-faith security research that would otherwise violate the statute. The DOJ also said it will not bring “exceeds authorized access” cases based solely on violations of terms of service or company policies, except where those policies entirely prohibit access to specific files or systems. This is an internal DOJ guideline rather than a statutory defense, so it does not bind state prosecutors and does not guarantee protection in every federal case.
To qualify as good-faith security research, the activity must be conducted solely to test or correct a security vulnerability, must be designed to avoid harm to individuals or the public, and the findings must be used to improve security rather than for extortion or personal gain.8HackerOne Help Center. Safe Harbor Overview and FAQ Research done for extortion or personal enrichment does not qualify, regardless of what any agreement says. A tester operating without a written scope agreement that identifies the systems in play and authorizes the specific techniques is operating without the protection that keeps the conduct on the right side of the statutes.