Software theft penalties under U.S. federal law include criminal prison sentences of up to ten years, criminal fines up to $250,000 for individuals, and civil damages reaching $150,000 for each program infringed when the copying was willful. The exact exposure depends on how many copies were involved, their retail value, whether the conduct was for profit, and whether the copyright owner registered the work in time to claim the heaviest damages.
What Counts as Software Theft
Federal copyright law treats computer programs as literary works, which gives developers the exclusive right to control copying, distribution, and derivative versions. Most users don’t own the software they install; they hold a license under an End User License Agreement that limits how many devices they can use it on, whether they can transfer it, and whether they can modify the code. Breaking those terms through unauthorized copying or distribution crosses from contract breach into copyright infringement.
The conduct that gets prosecuted or sued over usually falls into a handful of patterns: buying one license and loading the program on multiple machines (softlifting), letting more employees access a server-hosted program than the license permits, sellers pre-installing unlicensed copies on new computers, downloading cracked versions from file-sharing sites, and sharing login credentials for subscription or cloud software among people who aren’t authorized users. The workplace versions tend to get rationalized as cost-saving. At scale, they create serious liability for the organization.
Criminal Penalties
Prosecutors use two statutes together. The Copyright Act makes willful infringement a federal crime when it’s done for commercial advantage or private financial gain, or when it involves reproducing or distributing copyrighted works above specified thresholds.1Office of the Law Revision Counsel. 17 U.S. Code 506 – Criminal Offenses A separate section of the federal criminal code sets the prison terms.
For infringement committed for commercial advantage or financial gain, the tiers run as follows:
- Reproducing or distributing at least 10 copies with a total retail value above $2,500 in any 180-day period is a felony punishable by up to five years in prison.
- A second or subsequent felony conviction raises the ceiling to ten years.
- Conduct below that 10-copy, $2,500 threshold is a misdemeanor punishable by up to one year.2Office of the Law Revision Counsel. 18 U.S. Code 2319 – Criminal Infringement of a Copyright
A separate track covers non-commercial infringement. Distributing copyrighted work worth more than $1,000 without any profit motive carries up to one year for a first offense and up to six years for repeat offenders.2Office of the Law Revision Counsel. 18 U.S. Code 2319 – Criminal Infringement of a Copyright Leaking pre-release software for financial gain carries up to five years of its own.
On top of prison time, individuals convicted of a felony face fines up to $250,000.3Office of the Law Revision Counsel. 18 U.S. Code 3571 – Sentence of Fine Organizations convicted of the same conduct can face steeper financial penalties at the court’s discretion.
Civil Damages
A criminal case is not the only risk. Copyright holders routinely sue, and the money exposure in a civil case can be as painful as a criminal fine.
The owner chooses between two damage theories. Actual damages require proving the profits lost plus any gain the infringer made from the stolen software. Statutory damages don’t require proof of specific losses.4Office of the Law Revision Counsel. 17 U.S. Code 504 – Remedies for Infringement: Damages and Profits
Statutory damages run from $750 to $30,000 per work infringed, set by the court at whatever amount it finds just. When the infringement was willful, the ceiling rises to $150,000 per work.4Office of the Law Revision Counsel. 17 U.S. Code 504 – Remedies for Infringement: Damages and Profits The “per work” language is where the math gets ugly. A company running ten unlicensed programs faces damages calculated separately for each one.
Courts can also issue temporary or permanent injunctions ordering the infringer to stop using the software entirely.5Office of the Law Revision Counsel. 17 U.S. Code 502 – Remedies for Infringement: Injunctions A prevailing party may also recover reasonable attorney’s fees at the court’s discretion, which in intellectual property litigation often exceeds the underlying damages.6Office of the Law Revision Counsel. 17 U.S. Code 505 – Remedies for Infringement: Costs and Attorneys Fees
The Registration Catch
Statutory damages and attorney’s fees are only available if the copyright was registered before the infringement began, or within three months of the software’s first publication.7Office of the Law Revision Counsel. 17 U.S. Code 412 – Registration as Prerequisite to Certain Remedies for Infringement When registration wasn’t timely, the developer is limited to actual damages. Major publishers register as a matter of course; smaller developers sometimes don’t.
DMCA Penalties for Cracking Protections
Using cracked software triggers a separate layer of liability. The Digital Millennium Copyright Act makes it illegal to circumvent technological protection measures such as activation keys, license servers, and digital rights management systems, independent of whether traditional infringement also occurred.8Office of the Law Revision Counsel. 17 U.S. Code 1201 – Circumvention of Copyright Protection Systems Making or distributing cracking tools carries its own penalties on top of any infringement claim.
Narrow exceptions exist. Someone who lawfully obtained a program may bypass its protections solely to achieve interoperability with an independently created program. Encryption researchers acting in good faith and authorized security testers also get limited safe harbors.8Office of the Law Revision Counsel. 17 U.S. Code 1201 – Circumvention of Copyright Protection Systems None of those shield someone who cracked a license key simply to avoid paying for the software.
Personal Liability for Officers and Directors
When software theft happens inside a business, the liability doesn’t stop at the company. Corporate officers and directors can be held personally liable for infringement if they had a financial interest in the business and supervised or directed the infringing activity. That’s a low threshold in a small company where the owner decides which software to buy and how many licenses to purchase.
Executives who didn’t personally install anything can still face vicarious liability if they had the right and ability to control the activity, benefited financially, and failed to stop it. A company that saves money by under-licensing is financially benefiting, and the officers who approved the budget arguably had the ability to prevent the shortfall. Willful infringement judgments are particularly dangerous because they’re generally non-dischargeable in bankruptcy. You can’t file your way out of them.
Defenses That May Reduce Exposure
Innocent Infringement
If the infringer genuinely didn’t know and had no reason to believe the conduct was infringement, a court may reduce statutory damages to as low as $200 per work.9U.S. Copyright Office. Copyright Law of the United States, Chapter 5 – Copyright Infringement and Remedies This defense doesn’t eliminate liability. Copyright infringement is a strict liability claim, so intent isn’t required for a finding of liability; the defense only lowers damages. Courts tend to reject it when the software carried a visible copyright notice or when the circumstances of acquiring it were suspicious. Large companies almost never succeed with it.
Fair Use
Fair use allows limited use of copyrighted material without permission for purposes like criticism, comment, teaching, and research. Courts weigh the purpose and character of the use, the nature of the work, how much was used, and the effect on the market for the original.10Office of the Law Revision Counsel. 17 U.S. Code 107 – Limitations on Exclusive Rights: Fair Use It rarely helps someone accused of software piracy. Installing a complete copy of a commercial program to avoid paying for it fails every factor. The doctrine is more relevant to security research, academic study, or interoperability testing, and even there the line is narrow.
Time Limits
Federal prosecutors must bring criminal copyright charges within five years after the offense.11Office of the Law Revision Counsel. 17 U.S. Code 507 – Limitations on Actions Civil copyright claims must be filed within three years after the claim accrues.
Under the discovery rule, that three-year clock starts when the copyright owner learned or should have learned about the infringement rather than when the copying happened. In 2024, the Supreme Court held in Warner Chappell Music v. Nealy that an owner who files within the three-year discovery window can seek damages for infringement that occurred many years earlier. The Court didn’t definitively settle whether the discovery rule itself is required under the Copyright Act, leaving that question open. The practical point for anyone with old unlicensed installations still running: age alone doesn’t put the conduct out of reach.
How Violations Get Found
Detection is more effective than most offenders expect. Developers embed license codes, digital watermarks, and activation checks into their products, and many programs periodically phone home to confirm the installation is legitimate. When those checks fail or when one license key shows up on an unusual number of machines, the developer’s compliance team notices.
Industry groups like the Business Software Alliance investigate suspected piracy, often starting with a tip from a current or former employee. The BSA typically asks the company to self-audit installed software against purchase records. Cooperation can lead to a confidential settlement. Refusing cooperation risks a court-ordered audit, which is more disruptive and more expensive. Whistleblowers who report unlicensed use may receive a percentage of any recovery, giving disgruntled employees a direct financial incentive to report.
Digital forensics has made detection easier at scale. Investigators scan networks for unauthorized software signatures, identify cracked installations by their modified code, and trace pirated copies back to their source. In an organization running dozens or hundreds of machines, the gap between purchased licenses and actual installations usually surfaces quickly once anyone looks for it.
Open-Source Licenses Carry the Same Penalties
The penalties above aren’t limited to pirating commercial programs. Open-source software has its own license terms, and violating them creates the same copyright infringement exposure. Licenses like the GPL require anyone distributing modified versions to make their own source code available under the same terms. A company that incorporates GPL-licensed code into a proprietary product without complying loses its license to use the code, and continued use becomes infringement.
The consequences line up with those for commercial piracy: statutory damages up to $150,000 per work when the copyright was registered, injunctions that can force a product off the market, and potential attorney’s fee awards. “Free” software isn’t free of legal obligations, and the compliance requirements are just as enforceable as any commercial EULA.