What Is Computer Theft? CFAA, Penalties, and Defenses

Computer theft is the unauthorized use of a computer system to obtain information, commit fraud, cause damage, or extort money, and it is a federal crime under the Computer Fraud and Abuse Act at 18 U.S.C. § 1030, with parallel statutes in every state. Penalties run from one year in prison for a basic unauthorized-access offense to twenty years for serious damage or national security violations, and a single incident often triggers charges under several statutes at once.

What the Law Covers

The Computer Fraud and Abuse Act is the backbone of federal computer crime prosecution. It targets several distinct categories of conduct, and the category matters because the penalties differ sharply.

Accessing a protected computer without permission and obtaining information from it, whether financial records, government data, or any other data on the system.
Accessing a protected computer without authorization with intent to defraud and obtaining something of value.
Knowingly transmitting code or commands that cause damage to a protected computer, which covers malware and ransomware.
Knowingly selling or distributing passwords or similar credentials that would permit unauthorized access.
Threatening to damage a protected computer, threatening to steal or expose its data, or demanding payment in connection with damage already caused.

Each offense requires that the target be a “protected computer.”¹

What Counts as a Protected Computer

The statutory term is effectively limitless. It covers any computer used in or affecting interstate or foreign commerce or communication, which courts have read to include smartphones, personal laptops, cloud servers, and internet-connected appliances. The definition also specifically includes computers used by financial institutions, the U.S. government, and voting systems used in federal elections.¹

If a device connects to the internet, assume the CFAA reaches it.

Unauthorized Access vs. Exceeding Authorized Access

The statute separates two kinds of wrongful access, and the line between them has produced more litigation than almost any other part of the law.

“Without authorization” is the straightforward case. Someone with no right to use a system gets in anyway. A hacker who exploits a vulnerability or guesses a stranger’s credentials falls here.

“Exceeding authorized access” is harder. It applies to someone who has legitimate access but obtains information from areas that are off-limits. In Van Buren v. United States (2021), a police officer used valid credentials to search a law enforcement database for personal reasons in exchange for money. The Supreme Court held that “exceeds authorized access” means reaching files, folders, or databases that a person’s credentials don’t permit, not using permitted access for an improper purpose.²

That ruling narrowed the statute considerably. Before Van Buren, some courts treated any violation of a computer use policy as a potential federal crime. The Court rejected that reading, noting it would criminalize ordinary conduct like checking personal email on a work computer. The question now is whether the person entered an area they weren’t entitled to enter, not whether they used permitted access for an unapproved reason.²

Common Forms of Computer Theft

Prosecutors see the same patterns repeatedly, and a single case often involves more than one.

Data Theft

The most common form is accessing a system without permission and copying or downloading information. The data doesn’t need to be deleted from the original source. Obtaining a copy is enough. Targets range from customer databases and financial records to trade secrets and classified government material. Under the CFAA, even accessing information without authorization is a standalone offense regardless of whether the perpetrator later uses or sells it.¹

Ransomware and Extortion

Ransomware, where a perpetrator encrypts a victim’s files and demands payment for the decryption key, fits directly under the CFAA’s extortion provision. The statute makes it a crime to transmit a threat to damage a protected computer, to threaten to steal or expose data, or to demand payment connected to damage already done. A first offense carries up to five years in prison, and a second conviction carries up to ten.¹

Theft of Services

Using someone else’s computing resources without permission is also computer theft. Hijacking cloud accounts, using a neighbor’s internet after being told to stop, or secretly installing cryptocurrency mining software on another person’s hardware all qualify. The CFAA treats fraudulent access that obtains “anything of value” as a crime, and courts have found computing resources carry value even when no physical object changes hands.¹

Identity Theft Through Computer Access

When the perpetrator uses someone’s personal information to impersonate them, aggravated identity theft comes in. That offense carries a mandatory two-year prison term when the identity is used during and in connection with certain felonies, including computer fraud. The two years run consecutively, added on top of whatever sentence the underlying felony carries. Courts cannot run it concurrently and cannot shrink the underlying sentence to compensate.³

Federal Penalties

CFAA penalties scale with the seriousness of the conduct and whether the defendant has prior convictions.

Obtaining information without authorization under § 1030(a)(2): up to one year for a first offense. The ceiling rises to five years if the offense was committed for financial gain, to further another crime, or if the information taken exceeds $5,000 in value. A second conviction carries up to ten years.
Computer fraud with intent to defraud under § 1030(a)(4): up to five years for a first offense, ten for a repeat.
Intentional damage under § 1030(a)(5)(A): up to ten years for a first offense, twenty for a second. Recklessly causing damage through unauthorized access carries up to five years on a first offense.
Computer extortion under § 1030(a)(7): up to five years for a first offense, ten for a subsequent conviction.
Accessing national security information under § 1030(a)(1): the most serious category, up to ten years for a first offense and twenty for a second.

Fines apply to all of these offenses, and multiple counts in one prosecution are routine.¹

Charges That Stack on Top

Federal prosecutors rarely bring a CFAA charge alone. Several other statutes commonly ride with it.

Wire Fraud

Wire fraud is the workhorse. It applies to anyone who uses electronic communications to carry out a scheme to defraud, and virtually every computer-based fraud involves wire transmissions. The maximum is 20 years, higher than the CFAA ceiling for most offenses. When the fraud affects a financial institution, the maximum rises to 30 years and a $1,000,000 fine.⁴

Trade Secret Theft

When the target is proprietary business information, the Economic Espionage Act adds another layer. Stealing trade secrets by any means, including computer intrusion, carries up to ten years for individuals. Organizations face fines of up to $5,000,000 or three times the value of the stolen trade secret, whichever is greater.⁵

Copyright Circumvention

The Digital Millennium Copyright Act bans bypassing technological measures that control access to copyrighted works. It reaches cracking software protection, breaking encryption on digital media, and selling tools designed primarily for circumvention. The DMCA operates independently from the CFAA, so hacking a system to pirate protected content can bring charges under both.⁶

State Computer Crime Laws

All fifty states have enacted their own computer crime statutes.⁷ The scope and terminology vary, but most cover the same core conduct: unauthorized access, data theft, introduction of malware, and disruption of computer services. Some states treat these as standalone computer crime offenses; others fold them into broader theft or fraud statutes.

A notable difference from federal law is where the misdemeanor-to-felony line sits. Many states escalate the charge based on the monetary value of the data or services taken, with thresholds commonly in the $2,000 to $2,500 range. State and federal charges aren’t mutually exclusive. One act of computer theft can lead to prosecution under both the CFAA and a state statute, because the dual sovereignty doctrine permits separate proceedings by different governments over the same conduct.

Civil Lawsuits Under the CFAA

The CFAA isn’t only a criminal statute. Victims can sue. A person or business that suffers damage or loss from a CFAA violation can bring a civil action for compensatory damages and injunctive relief, provided the case meets at least one of several qualifying conditions. The condition invoked most often is that the victim suffered at least $5,000 in aggregate losses during any one-year period.¹

The statute defines “loss” broadly. It includes the cost of responding to the offense, conducting damage assessments, restoring data or systems, and any revenue lost or consequential damages from service interruptions.⁸ Forensic investigation and system hardening after a breach often push losses past the $5,000 floor on their own. The statute of limitations for civil CFAA claims is two years from the date of the offense or the date the victim discovered the damage, whichever is later.¹

Gray Areas and Common Defenses

Not every situation involving questionable access is a clear-cut crime. Several fact patterns sit in legal gray zones.

Password sharing. Using someone else’s credentials creates CFAA exposure, but the risk depends on context. Courts have separated cases where access was explicitly revoked, such as a terminated employee whose credentials should have been disabled, from situations where an authorized user voluntarily shares a password with a friend or family member. Some CFAA provisions require intent to defraud, which limits their reach against casual sharing, but other provisions lack that requirement and could theoretically apply.

Workplace snooping. After Van Buren, an employee with legitimate access to a company database who searches it out of curiosity or spite is less likely to face federal charges. The question is whether the employee reached areas of the system they weren’t permitted to enter at all, not whether they used permitted access for an unapproved reason. Employer policies against personal use, standing alone, no longer turn policy violations into federal crimes.

Security research. Researchers probing systems for vulnerabilities sit uncomfortably with the statute. Even well-intentioned testing of a system you don’t own can technically satisfy the elements of unauthorized access. Some companies address this through bug bounty programs that provide explicit authorization, and the Department of Justice has issued a policy generally declining to prosecute good-faith security research. That policy isn’t binding law, and the statute itself contains no security research exception.

Web scraping. Automated collection of publicly available data has drawn significant CFAA litigation. Recent decisions, reinforced by Van Buren’s reasoning, point toward the view that gathering information already available to the general public is unlikely to violate the CFAA, even if it breaks a website’s terms of service. Scraping data from behind a login wall, or continuing after a cease-and-desist, is a different matter.

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
2
Supreme Court of the United States. Van Buren v United States, 593 US 374 (2021)
3
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
4
Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
5
Office of the Law Revision Counsel. 18 USC 1832 – Theft of Trade Secrets
6
Office of the Law Revision Counsel. 17 USC 1201 – Circumvention of Copyright Protection Systems
7
Congress.gov. Cybercrime and the Law – Primer on the Computer Fraud and Abuse Act
8
Legal Information Institute. 18 USC 1030(e)(11) – Definition of Loss