Cyber terrorism is the use of computers and networks to carry out attacks intended to intimidate a civilian population, coerce a government, or cause the kind of serious harm that terrorism statutes were written to punish. No federal statute defines the phrase outright. Instead, prosecutors combine the general terrorism definitions in 18 U.S.C. § 2331 with the Computer Fraud and Abuse Act (18 U.S.C. § 1030), and a separate statute, 18 U.S.C. § 2332b, explicitly lists certain computer offenses as potential “federal crimes of terrorism.”1Office of the Law Revision Counsel. 18 USC 2331 – Definitions Penalties scale with harm, reaching life imprisonment when an attack causes death.
How Cyber Terrorism Differs From Ordinary Cybercrime
The dividing line is motive, not technique. A hacker who breaks into a bank’s servers to steal account numbers is committing a financial crime. A hacker who takes down a hospital network to pressure a government into changing policy is pursuing something closer to terrorism. Federal law defines terrorism around three goals: intimidating a civilian population, influencing government policy through coercion, or affecting government conduct through mass destruction, assassination, or kidnapping.1Office of the Law Revision Counsel. 18 USC 2331 – Definitions A cyber attack qualifies when it carries one of those objectives and involves conduct dangerous to human life that violates criminal law.
Hacktivism aims for temporary embarrassment or public attention. Cyber terrorism aims to shatter confidence and force concessions through fear of serious harm. State-sponsored operations complicate the picture further: cyber warfare is generally understood as state-on-state action equivalent to an armed attack, while cyber terrorism involves non-state actors, or state-backed groups, pursuing ideological ends through digital disruption.2Congress.gov. Cyberwarfare and Cyberterrorism: In Brief A Congressional Research Service analysis acknowledged that no clear criteria yet exist for sorting a given attack into crime, hacktivism, terrorism, or armed conflict. The legal tools available to prosecutors focus on individuals and organizations rather than foreign governments.
What Attackers Target
The federal government designates 16 critical infrastructure sectors whose disruption could cause debilitating consequences for national security, the economy, or public health.3Cybersecurity and Infrastructure Security Agency. Critical Infrastructure Security and Resilience They include energy, water and wastewater, financial services, healthcare, communications, transportation, dams, nuclear facilities, emergency services, food and agriculture, government facilities, information technology, defense, critical manufacturing, chemicals, and commercial facilities. Hitting one sector can trigger cascading failures in others.
Power grids draw the most attention because almost everything else depends on electricity. Attacks on portions of Ukraine’s electric grid in 2015 and 2016 left roughly 250,000 customers without power in the first incident and used specialized malware capable of directly manipulating grid equipment in the second. Water systems face similar exposure: in February 2021, an unauthorized user remotely accessed a Florida water treatment plant’s control system and tried to raise sodium hydroxide to dangerous levels before operators caught and reversed the change.4Cybersecurity and Infrastructure Security Agency. Compromise of U.S. Water Treatment Facility Financial networks, government databases, and transportation systems round out the highest-value targets, chosen because their failure radiates outward.
Common Attack Methods
Distributed Denial of Service (DDoS) attacks flood a target’s servers with traffic from thousands of compromised devices until the systems collapse. Aimed at government portals, emergency services, or financial platforms, they cut the public off from critical resources during a crisis.
Destructive malware behaves differently from the commercial ransomware that dominates headlines. A profit-driven attacker encrypts files and waits for payment; a terrorist-motivated variant may permanently destroy data or lock systems with no intention of providing a decryption key. The goal is paralysis.
Attacks on industrial control systems reach into the physical world. Supervisory Control and Data Acquisition (SCADA) systems manage dam gates, chemical levels in water treatment, and pipeline pressures. The Stuxnet attack discovered in 2010 destroyed nearly 1,000 uranium enrichment centrifuges in Iran through code that manipulated the equipment those computers controlled. In 2017, the Triton malware targeted safety systems at a Saudi Arabian petrochemical plant, attempting to disable the very safeguards designed to prevent catastrophic failures.
Supply chain compromise bypasses hardened targets by attacking the software vendors they trust. Malicious code gets injected into a legitimate update, and the victim installs it willingly. A single compromised vendor can open doors to thousands of downstream organizations before anyone notices.
Federal Statutes That Apply
The Computer Fraud and Abuse Act
The Computer Fraud and Abuse Act (18 U.S.C. § 1030) is the primary federal law for prosecuting computer-based attacks. It covers everything from accessing government computers without authorization to intentionally transmitting code that damages a “protected computer.”5Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers That category is broad: a protected computer includes any machine used by or for the federal government, a financial institution, or in interstate or foreign commerce, which covers almost every machine connected to the internet.
The USA PATRIOT Act expanded the CFAA after September 11, 2001. Section 814 broadened the definitions of “damage” and “loss,” raised maximum prison terms for several offense categories, and added triggers such as threats to public health or safety and damage to government computers used for national defense.6Congress.gov. USA PATRIOT Act, Public Law 107-56 It also expanded government authority to monitor electronic communications and access records held by internet service providers during national security investigations.
The “Federal Crime of Terrorism” Designation
The general terrorism definitions in 18 U.S.C. § 2331 do not mention computers, but the language reaches cyber attacks that endanger lives. The more direct link comes from 18 U.S.C. § 2332b, which defines “federal crime of terrorism” and explicitly lists CFAA violations among the qualifying offenses. Obtaining national security information through unauthorized computer access under § 1030(a)(1) and intentionally damaging a protected computer under § 1030(a)(5)(A) both qualify when the conduct is calculated to influence or affect government conduct by intimidation or coercion.7Office of the Law Revision Counsel. 18 USC 2332b – Acts of Terrorism Transcending National Boundaries That cross-reference is the closest thing federal law has to a working definition of cyber terrorism.
Material Support
Providing technical help to a terrorist organization is itself a federal crime, even if the person providing it never carries out an attack. Under 18 U.S.C. § 2339A, “material support or resources” includes training, expert advice or assistance, communications equipment, and facilities, among other items.8Office of the Law Revision Counsel. 18 USC 2339A – Providing Material Support to Terrorists Someone who builds hacking tools, sets up secure infrastructure, or trains members of a designated foreign terrorist organization faces prosecution under 18 U.S.C. § 2339B, which carries up to 20 years in prison, or life if anyone dies as a result.9Office of the Law Revision Counsel. 18 USC 2339B – Providing Material Support or Resources to Designated Foreign Terrorist Organizations
Criminal Penalties
Sentences under the CFAA depend on the type of offense, the resulting harm, and whether the defendant has prior convictions. Penalties escalate sharply when attacks produce physical consequences:
- Obtaining national security information through unauthorized access: up to 10 years for a first offense, up to 20 years for a subsequent conviction.
- Intentionally damaging a protected computer by transmitting malicious code: up to 10 years for a first offense, up to 20 years for a repeat offender.
- Recklessly causing damage through unauthorized access: up to 5 years, rising to 20 years for a second offense.
- Causing serious bodily injury through intentional computer damage: up to 20 years.
- Causing death through intentional computer damage: any term of years up to life imprisonment.5Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
Federal fines follow the general sentencing statute at 18 U.S.C. § 3571, which caps individual felony fines at $250,000 and organizational fines at $500,000.10Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine If the offense produces financial gain to the defendant or loss to the victim, the fine can rise to twice that amount. When conduct qualifies as a “federal crime of terrorism” under § 2332b, that classification unlocks additional investigative tools and can influence sentencing under federal guidelines. A material support conviction under § 2339B stacks on top of whatever sentence the underlying computer crime carries. Convicted individuals also commonly face extended post-release supervision and restrictions on computer access.
Mandatory Incident Reporting Under CIRCIA
The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) requires operators of critical infrastructure to report significant cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA). Covered entities must report a qualifying cyber incident within 72 hours of reasonably believing one has occurred, and any ransomware payment within 24 hours of making it.11Cybersecurity and Infrastructure Security Agency. Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) The clock starts on reasonable belief, not on confirmation.
CIRCIA covers entities across the 16 critical infrastructure sectors, generally applying to organizations that exceed Small Business Administration size thresholds for their industry. Some businesses are covered regardless of size when their disruption would pose an outsized risk. The final reporting rule is expected to take effect in 2026, and supplemental reports are required whenever significant new information emerges after an initial filing. Cyber terrorism often begins as an ambiguous intrusion that could be criminal, destructive, or something in between; the 72-hour window ensures federal agencies receive early warning either way.