What Is Computer Tampering? CFAA Penalties, Defenses, and Reporting

Computer tampering is the crime of knowingly accessing someone else’s computer, data, or network without permission, or intentionally damaging a system you have no authority to alter. Under the federal Computer Fraud and Abuse Act (18 U.S.C. § 1030), penalties start at one year in jail for basic unauthorized access and reach life imprisonment when the tampering causes a death.¹ Every state has its own version of the law, and federal and state charges can be brought together.

What Counts as Computer Tampering

The federal statute defines “damage” as any impairment to the integrity or availability of data, a program, a system, or information. That one word covers a lot. Deleting a single record, wiping a server, or changing a program’s code so it behaves differently all qualify. The change doesn’t need to be permanent; even temporary modifications that require technical work to reverse are enough.

Disrupting a computer service is the other main category. Flooding a server with traffic to knock it offline, disabling security measures, or planting malware all fall here. The CFAA specifically reaches anyone who “knowingly causes the transmission of a program, information, code, or command” that intentionally damages a protected computer, language written to cover viruses, worms, and other malicious code.

Ransomware sits in its own slot. Under 18 U.S.C. § 1030(a)(7), it is a separate offense to send any communication in interstate commerce with intent to extort money or anything of value by threatening to damage a protected computer, threatening to release stolen data, or demanding payment after causing damage. An operator who encrypts a company’s files and demands cryptocurrency faces charges for the damage and for the extortion demand.¹

One boundary worth noting: the CFAA applies to “protected computers,” but the term is broader than it sounds. It covers any computer used by a financial institution or the federal government, any computer in a federal voting system, and any computer “used in or affecting interstate or foreign commerce or communication.” Courts read that last category to include essentially any device connected to the internet.

Intent and Authorization: What Prosecutors Have to Prove

Accidentally breaking something on a computer is not a crime. To convict under the CFAA, the government must prove the defendant acted knowingly or intentionally. For the most serious damage charges, prosecutors must show the defendant “knowingly caused the transmission” of code or commands and “intentionally caused damage.” The statute explicitly excludes claims based on negligent design or manufacture of hardware or software, which rules out prosecuting someone for a bug they didn’t know they were introducing.¹

The second element is lack of authorization. This splits into two ideas: accessing a system you have no right to use, and exceeding the access you were given. An employee with a login to a company payroll system who uses it to change their own salary has exceeded authorized access, even though the password worked.

The Van Buren Line

The Supreme Court narrowed what “exceeds authorized access” means in Van Buren v. United States (2021). The Court held that a person exceeds authorized access only when they enter areas of a system that are off-limits to them — files, folders, or databases they’re not supposed to reach. Using information you are authorized to access for an improper purpose does not violate the CFAA.²

The Department of Justice’s charging policy follows that distinction. DOJ attorneys will not bring “exceeds authorized access” charges based solely on a violation of a contract, terms of service, or workplace policy. The restriction has to be technical, enforced through code or system configuration, not just a written rule the employee ignored. Checking personal email on a work laptop against company policy is not a federal crime.³

Federal Penalties Under the CFAA

Maximum sentences under 18 U.S.C. § 1030(c) vary by violation and by whether the defendant has a prior conviction. The major categories:

Unauthorized access to obtain information for espionage: up to 10 years for a first offense, up to 20 years for a repeat.
Unauthorized access to obtain information generally: up to 1 year for basic access; up to 5 years for a first offense (10 for a repeat) if the access was for commercial advantage, in furtherance of a crime, or involved information worth more than $5,000.
Computer fraud: up to 5 years for a first offense, up to 10 for a repeat.
Intentional damage to a protected computer: up to 10 years for a first offense, up to 20 for a repeat.
Reckless damage: up to 5 years for a first offense, up to 20 for a repeat.
Computer extortion: up to 5 years for a first offense, up to 10 for a repeat.
Damage resulting in serious bodily injury: up to 20 years.
Damage resulting in death: any term of years, or life imprisonment.

Actual sentences depend on the federal sentencing guidelines, the facts of the case, and judicial discretion.¹

Fines follow the general federal rule in 18 U.S.C. § 3571 rather than a schedule unique to computer crimes. For felony convictions, individuals face fines up to $250,000; organizations up to $500,000.⁴

Restitution comes on top. The CFAA defines “loss” broadly, covering the cost of responding to the offense, conducting a damage assessment, restoring data and systems, and revenue lost or costs incurred because of service interruptions. A defendant can owe the victim for a forensic investigator’s bill and for business revenue lost during downtime, and that obligation is separate from any fine paid to the government.¹

Several factors push a case into the higher penalty tiers. Losses aggregating at least $5,000 in any one-year period trigger harsher penalties. Tampering with government computers, financial institution systems, or voting infrastructure carries elevated charges. Interference with medical systems or anything that creates a risk of physical injury escalates further. Using computer tampering to commit fraud or identity theft adds charges for the underlying crime, which prosecutors routinely stack.

State Charges

Every state, plus Puerto Rico and the Virgin Islands, has computer crime statutes. Structures vary, but most laws address unauthorized access, data destruction, and interference with computer services, and most tier offenses by degree. The jump from misdemeanor to felony usually turns on the dollar amount of damage, whether the target was a government system or critical infrastructure, or whether the tampering was done to commit another crime.

Misdemeanor convictions at the state level generally carry a maximum of one year in jail. Felony convictions can mean multi-year prison terms, with upper ranges varying significantly by state. The CFAA does not preempt state law, so conduct that crosses state lines or involves federal systems can draw federal and state charges at the same time.

Common Defenses

Several defenses come up repeatedly, and the DOJ’s own charging policy recognizes some of them.

Authorization or consent. If the system owner gave permission, there is no violation. Ambiguous authorization or reliance on past practice can muddy this, but DOJ requires prosecutors to prove the defendant “knew of the facts that made the defendant’s access unauthorized at the time” before charging.³

Good-faith security research. DOJ policy directs prosecutors to decline charges when the evidence shows the defendant accessed a computer solely to test, investigate, or fix a security flaw, did so in a way designed to avoid harm, and used the findings to improve security for that class of devices or services. Bug bounty researchers and penetration testers fall into this category when they stay within those boundaries.³

Lack of criminal intent. Because most CFAA violations require knowing or intentional conduct, a defendant who genuinely didn’t realize they were in restricted territory has a real defense. Accidental access, confusion about the scope of permissions, or poorly configured systems that exposed data without any effort to bypass security can all defeat the intent element.

Mere policy violations. After Van Buren, violating a website’s terms of service or an employer’s acceptable-use policy, without more, does not count as exceeding authorized access. The restriction has to be a technical barrier.²

Civil Lawsuits by Victims

Computer tampering isn’t only a criminal matter. Under 18 U.S.C. § 1030(g), anyone who suffers damage or loss from a CFAA violation can sue for compensatory damages and injunctive relief.¹

A civil suit is only available, however, if the conduct meets at least one qualifying factor:

Total losses to one or more victims aggregating at least $5,000 in any one-year period.
Modification or impairment of medical examination, diagnosis, treatment, or care.
Physical injury to any person.
A threat to public health or safety.
Damage to a computer used by the federal government for justice, defense, or national security.

If the only qualifying factor is the $5,000 loss, recovery is limited to economic damages. The statute does not explicitly authorize punitive damages or attorney fees. And the CFAA bars civil suits based on negligent design or manufacture of hardware or software, so it is not a vehicle for suing a tech company over an insecure product.¹

Statute of Limitations

For federal criminal charges under the CFAA, the general five-year federal statute of limitations applies. The CFAA has no special extended deadline, and the ten-year clock in 18 U.S.C. § 3293 for certain financial fraud offenses does not cover CFAA violations.

For civil CFAA suits, the window is tighter. A plaintiff must file within two years of the act that caused the damage, or within two years of the date they discovered the damage, whichever is later.¹

State criminal deadlines vary. Most fall in the three-to-five-year range for felony computer crimes, though some states run longer windows for offenses involving critical infrastructure or large financial losses.

How To Report Computer Tampering

Victims can file a complaint with the FBI’s Internet Crime Complaint Center (IC3). The IC3 is a clearinghouse rather than an investigative body. Analysts review complaints, research them, and route them to the appropriate law enforcement agency. The IC3 does not run investigations itself and does not provide status updates.⁵

When filing, you’ll need contact information, details about any financial losses including account and transaction data, whatever identifying information you have about the person responsible, and a description of what happened. Preserve any technical evidence — network logs, hard drive images, malware samples, emails with full headers — in a secure location. The IC3 does not accept attachments, but an investigating agency may ask for the originals later.⁵

If the situation is time-sensitive or anyone is in immediate danger, contact local law enforcement directly instead of going through the IC3. Cases involving significant financial loss or threats to critical infrastructure can also be reported to the local FBI field office.

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
2
Supreme Court of the United States. Van Buren v. United States
3
U.S. Department of Justice. Justice Manual 9-48.000 – Computer Fraud and Abuse Act
4
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
5
Internet Crime Complaint Center. Frequently Asked Questions