Writing a computer virus is not, by itself, a federal crime in the United States. A computer virus becomes illegal the moment someone transmits it to a system without permission, distributes it to others who will, uses it to steal data or money, or leverages it to extort a victim. The federal law doing most of the work here is the Computer Fraud and Abuse Act (CFAA), and depending on what was done and what it cost the victim, penalties run from one year to 20 years in prison, plus fines and restitution.
Where Legal Code Becomes a Crime
The CFAA does not criminalize the act of writing malicious code. It criminalizes specific harmful actions done with code: accessing computers without authorization, transmitting programs that cause damage, stealing information, and making extortion threats involving computers. A security researcher who writes a proof-of-concept virus in a lab to study a vulnerability has not committed a federal crime. Release that same code onto someone else’s system without permission, and federal law applies.
The line is not quite as clean as “creation is fine, deployment is illegal.” If you write a virus and hand it to someone you know plans to use it maliciously, conspiracy and aiding-and-abetting charges can follow. A handful of state laws go further than the CFAA and criminalize possessing or creating malware intended for use against others. The code itself is not the crime; nearly everything surrounding its use can be.
What the CFAA Prohibits
The CFAA, codified at 18 U.S.C. § 1030, protects “protected computers,” a category the statute defines to include financial institution systems, federal government systems, voting systems used in federal elections, and any computer involved in interstate or foreign commerce or communication.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers That last category sweeps in essentially any internet-connected device.
Several categories of conduct are prohibited, and knowing which applies matters because the penalties differ sharply.
Unauthorized Access and Exceeding Authorized Access
Breaking into a system you have no permission to use is the plainest violation. The CFAA also reaches people who have some legitimate access but go into areas off-limits to them. In Van Buren v. United States, the Supreme Court held that “exceeds authorized access” means reaching files, folders, or databases a person’s authorization does not cover.2Supreme Court of the United States. Van Buren v. United States, No. 19-783 An employee who opens a restricted database they were never given rights to view violates the statute. An employee who checks personal email on a work computer against company policy does not.
Transmitting Code That Causes Damage
This is the provision aimed directly at viruses. The CFAA makes it a crime to knowingly transmit a program, code, or command that intentionally causes damage to a protected computer without authorization. “Damage” means any impairment to the integrity or availability of data, a program, a system, or information, which covers corrupting files, crashing systems, encrypting data with ransomware, and disabling security software. Reckless conduct is reached too: knowingly transmitting code that recklessly causes damage is still a crime, with lower penalties.
Computer Fraud
Accessing a protected computer without authorization (or exceeding authorization) to further a fraud and obtain something of value is its own offense. Deploying a keylogger to capture banking credentials or using malware to skim card numbers at the point of sale fits here. There is a threshold: if the fraud involves only use of the computer itself, and that use is worth $5,000 or less in a one-year period, this specific provision does not apply.
Extortion and Ransomware
The CFAA separately covers extortion by computer threat. Transmitting a communication in interstate commerce containing a threat to damage a protected computer, a threat to steal or expose information from one, or a demand for money tied to damage already caused is a crime. Ransomware fits squarely: an attacker encrypts files, then demands payment for the key.
A warning for victims who pay: the Treasury Department’s Office of Foreign Assets Control (OFAC) has said that paying sanctioned cybercriminal groups violates U.S. sanctions law, even when the victim did not know the attackers were listed. OFAC applies strict liability, so not knowing who the attackers were is not a defense, and companies that pay can face substantial civil penalties.
Prison Time and Fines
The CFAA has no single penalty. The sentence depends on which subsection applied, whether it was a first or repeat offense, and the harm caused.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers The main tiers:
- Accessing government or financial institution computers to obtain restricted information (espionage-related): up to 10 years for a first offense, up to 20 years for a repeat offense.
- Simple unauthorized access or exceeding authorized access, first offense with no aggravating factors: up to one year. That rises to five years if the offense was for financial gain, to further another crime, or if the information obtained exceeded $5,000 in value. A repeat offense carries up to 10 years.
- Computer fraud and extortion, including ransomware: up to five years for a first offense, up to 10 years for a repeat offense.
- Intentionally transmitting code that causes damage: up to 10 years for a first offense. Recklessly causing damage through code transmission carries up to five years for a first offense.
Every tier carries a fine. Federal criminal fines under 18 U.S.C. § 3571 reach $250,000 for individuals convicted of felonies. Courts can also order restitution, requiring the offender to pay victims for system repair, data recovery, and lost revenue.3Office of the Law Revision Counsel. 18 US Code 3663A – Mandatory Restitution to Victims of Certain Crimes
For most damage-based offenses, losses must aggregate to at least $5,000 in a one-year period to support felony prosecution. The statute defines “loss” broadly: direct damage, the cost of investigating the breach, assessing it, restoring systems, and lost revenue from service interruptions. Serious malware incidents clear this line without difficulty.
Charges That Commonly Stack On
Malware cases are rarely charged under the CFAA alone. Prosecutors routinely add offenses that carry much heavier sentences of their own.
Wire fraud under 18 U.S.C. § 1343 applies whenever electronic communications are used to carry out a fraud scheme. Since malware travels over the internet, the fit is natural. Wire fraud carries up to 20 years, and up to 30 years with a fine of up to $1,000,000 if the scheme affects a financial institution.4Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television The headline-grabbing prison terms in major malware prosecutions tend to come from stacking wire fraud onto CFAA counts.
Aggravated identity theft under 18 U.S.C. § 1028A is common when malware harvests personal information. It carries a mandatory two-year consecutive sentence on top of whatever other penalties the defendant receives.
Civil Lawsuits by Victims
The CFAA is not purely criminal. It gives victims a private right of action against the person who damaged their systems. Anyone who suffers damage or loss from a CFAA violation can sue for compensatory damages and injunctive relief. The suit has to be filed within two years of the harmful act or the discovery of the damage, whichever is later.
A civil CFAA case does not depend on the government bringing criminal charges first. A business hit by a virus from a disgruntled former employee can pursue damages on its own. The hard part is practical: identifying the attacker and finding assets to collect against, which is why most civil CFAA cases involve known insiders rather than anonymous outside hackers.
State Computer Crime Laws
All 50 states, Puerto Rico, and the U.S. Virgin Islands have their own computer crime statutes.5National Conference of State Legislatures. Computer Crime Statutes They generally cover the same core conduct as the CFAA: unauthorized access, causing damage, stealing data. Definitions, offense classifications, and penalties vary. Some states treat a first trespass as a misdemeanor with a fine under $10,000; others classify serious data destruction as a high-level felony.
A single attack can trigger both federal and state prosecution. A virus that crosses state lines or affects computers in more than one state gives federal prosecutors jurisdiction, and each state where damage occurred can bring its own charges. Double jeopardy does not block this result, because the federal government and the states are separate sovereigns.