When Is Grey Hat Hacking Illegal? CFAA, DMCA, and Penalties

Grey hat hacking is illegal the moment you access a computer system without the owner’s permission, no matter how good your intentions are or how carefully you handle what you find. Under federal law, the unauthorized access itself is the crime. Reporting the vulnerability afterward, causing no damage, and even helping the company patch the flaw do not undo the violation. A first offense can carry up to a year in federal prison; if the information you obtained had commercial value or exceeded $5,000, that ceiling rises to five years. State charges and civil lawsuits can land on top.

Permission, Not Intent, Is the Line

Computer crime laws turn on authorization, not motive. A white hat hacker who runs a port scan, exploits a vulnerability, and writes a report is acting legally if the system owner authorized the work in advance. A grey hat performing the same actions without that authorization has committed a crime. The technical conduct is identical; the legal exposure is not.

This surprises people who assume good faith is a defense. Intent affects sentencing and whether prosecutors bring charges at all, but it does not defeat the underlying offense. A grey hat who finds a critical flaw and emails the company has still accessed the system without permission. The company might thank them, ignore them, or call the FBI. All three outcomes happen regularly, and the hacker has no legal right to expect the first one.

The Computer Fraud and Abuse Act

The primary federal statute is the Computer Fraud and Abuse Act, codified at 18 U.S.C. § 1030. The CFAA targets two core behaviors: accessing a computer without any authorization, and using authorized access to reach information you are not entitled to see or change.¹

The statute reaches an extremely wide category of machines. A “protected computer” includes any computer used in or affecting interstate commerce or communication, which in practice means any device connected to the internet.¹ A home router, a startup’s cloud server, and a hospital’s records system all qualify. Grey hats sometimes assume that publicly reachable systems are fair game for probing. Reachable is not the same as authorized.

Two more definitions matter. “Damage” means any impairment to the integrity or availability of data, a program, or a system. “Loss” is broader, covering the costs of responding to the incident, assessing damage, restoring systems, lost revenue, and other consequential harms.² A grey hat who crashes a server during testing has caused damage even if nothing was stolen, and the company’s investigation costs count as loss even if the hacker meant no harm.

What Van Buren Changed, and What It Didn’t

For years, prosecutors read “exceeds authorized access” broadly enough to cover almost anyone who used a computer in a way the owner would not have approved. In 2021, the Supreme Court narrowed that reading in Van Buren v. United States. The Court held that the phrase covers someone who accesses files, folders, or databases they are not entitled to reach, but not someone who accesses information available to them and then uses it for an improper purpose.³

The ruling does not help the typical grey hat. If you never had permission to be on the system at all, the simpler charge of access “without authorization” still applies, and Van Buren has nothing to say about it.

The DMCA Charge Grey Hats Forget

A second federal statute often gets overlooked. Section 1201 of the Digital Millennium Copyright Act prohibits circumventing technological measures that control access to copyrighted works.⁴ If you bypass authentication, encryption, or access controls on software to probe for vulnerabilities, the DMCA can stack on top of the CFAA.

The DMCA has a security testing exemption in subsection (j), but it requires authorization from the system owner or operator.⁴ Testing without permission cannot rely on it. The exemption also requires the testing be conducted solely to promote the security of the tested system and that the findings go to the developer, so posting results publicly before reporting them can void protection even for authorized testers.

What the Penalties Actually Look Like

The CFAA sets different ceilings depending on what was accessed, whether the hacker profited, and whether there is a prior conviction. The tiers most relevant to grey hat activity:

Basic unauthorized access to obtain information: up to one year in prison and a fine for a first offense. This is the charge most grey hats would face.²
Access for financial gain, or where the information’s value exceeds $5,000: up to five years. This tier catches hackers who ask to be paid for disclosing a vulnerability, or who reach data valuable enough to clear the threshold.²
Accessing national security information: up to ten years for a first offense, up to twenty for a repeat.²
Fraud with intent, including identity theft schemes: up to five years for a first offense, ten for a repeat.²
Causing damage to a protected computer: up to five years if the offense caused loss, threatened public health or safety, or affected ten or more computers in a year.²

Repeat offenders face sharply steeper penalties. A second conviction for basic unauthorized access jumps from one year to ten.²

Civil Lawsuits Are a Separate Risk

Prison is not the only exposure. The CFAA lets anyone who suffers damage or loss from a violation file a civil suit for compensatory damages and injunctive relief.² A company whose systems were accessed without permission can sue for incident investigation costs, system restoration, lost revenue from downtime, and other financial harm, even if no criminal case ever gets filed.

Claims must be filed within two years of the act or the discovery of the damage. If the only harm was loss rather than other aggravating factors, damages are limited to economic losses.² Even so, a company’s incident response alone can run into hundreds of thousands of dollars, all recoverable. This is where many grey hats get blindsided. They expect a thank-you email and receive a complaint instead.

State Charges Can Stack

Every state has its own computer crime statute alongside the federal CFAA, generally addressing unauthorized access or computer trespass. State charges can be filed independently or alongside federal ones.⁵ Elements, terminology, and penalties vary. Some states treat basic unauthorized access as a misdemeanor; others escalate to felonies when government systems, financial data, or critical infrastructure are involved.

A grey hat operating from one state against a server in another could face prosecution in either jurisdiction, or both. Federal CFAA charges do not preempt state charges. State-level computer trespass convictions commonly carry fines in the range of $5,000 to $10,000, with higher penalties when damage or sensitive data is involved.

What Pushes a Case From Ignored to Prosecuted

Not all grey hat activity ends in charges. Certain behaviors sharply raise the odds that a company or prosecutor treats the situation as a crime rather than a favor:

Demanding payment. Contacting a company with a vulnerability report and a price tag looks indistinguishable from extortion, even if the hacker frames it as a consulting fee. This can push a case out of the one-year tier and into the five-year financial-gain tier.
Downloading or copying data. Identifying a flaw is one thing. Pulling customer records, financial data, or source code to prove it exists goes beyond what a prosecutor is likely to view as benign.
Going public before reporting. Tweeting about a vulnerability or posting details before giving the company a chance to fix it looks more like public shaming than research, and it raises the company’s losses, which feed directly into the CFAA’s damage and loss math.
Touching government or financial systems. The CFAA singles these out for enhanced penalties.
Repeat activity. A single incident is more likely to end in a warning or a civil demand. A pattern across multiple companies suggests the hacker knows the rules and is choosing to ignore them.

The DOJ Policy Is Not a Legal Shield

In May 2022, the Department of Justice announced a revised policy directing federal prosecutors to decline prosecution of people engaged solely in good-faith security research, even where the conduct would technically violate the CFAA. The policy ties “good faith security research” to the definition used in the Copyright Office’s DMCA rulemaking: research conducted to test, investigate, or correct a security flaw in a way designed to avoid harm.

The shift is meaningful in tone and real in effect, but it has limits. The word “solely” raises questions about researchers who also get paid for the disclosure, present findings at a conference, or have mixed motivations. The policy is internal DOJ guidance, not a statutory change. A future administration can revise or rescind it. It does not bind state prosecutors, who can still charge under state computer crime statutes. And it does nothing about civil lawsuits by the affected company. Relying on this policy as a defense is a gamble.

The Legal Path for the Same Work

The safest way to do security research without catching a federal charge is through a formal vulnerability disclosure program or bug bounty. These programs provide written authorization to test specific systems under defined rules, which directly addresses the CFAA’s “without authorization” element.

Federal Agency Programs

Since 2020, a binding Cybersecurity and Infrastructure Security Agency directive has required all federal civilian agencies to publish a vulnerability disclosure policy. Each must describe which systems are in scope, what testing is allowed, and how to submit reports. The policy must commit the agency not to recommend or pursue legal action against anyone whose research represents a good-faith effort to follow it, and must treat that activity as authorized.⁶ Submitting a finding through the agency’s VDP is vastly safer than reporting through informal channels.

Private Bug Bounties

Platforms like HackerOne and Bugcrowd host bug bounty programs for thousands of private companies. These typically include safe harbor language that explicitly deems in-scope research “authorized” under the CFAA, the DMCA, and related laws, often with a commitment not to pursue civil or criminal action for good-faith violations of program rules.⁷

The catch is scope. Safe harbor applies only to systems owned by the company running the program. If testing touches a third-party cloud provider, payment processor, or API partner, the program operator cannot authorize that access, and the third party is not bound by the safe harbor.⁸ A researcher who accidentally pivots into connected infrastructure loses the protection for that part of the work.

How To Reduce Your Exposure

If you do security research, a few practices meaningfully lower the risk of criminal or civil consequences:

Check for authorization before you touch anything. If the target has a bug bounty program or VDP, follow it exactly. If it does not, ask whether the research is worth the risk.
Stay inside scope. Under a bounty, test only the systems listed as in-scope. Do not pivot to connected third parties.
Touch only what you need to confirm the flaw. Avoid downloading sensitive data, disrupting services, or modifying anything. The less interaction beyond identifying the vulnerability, the harder it is to argue damage.
Document what you accessed, when, and why. Contemporaneous notes showing a careful, limited approach are far more persuasive than after-the-fact explanations.
Never ask for payment outside an established program. If you want to be paid, work through a platform with a defined payment structure.
Report privately first. Give the owner a chance to fix the issue before any public disclosure; 90 days is the common industry window.

The gap between a grey hat and a white hat is not skill or motivation. It is paperwork. Written permission before testing is the single thing that separates a researcher from a defendant.

1
Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers
2
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
3
Supreme Court of the United States. Van Buren v. United States, 593 U.S. ___ (2021)
4
Office of the Law Revision Counsel. 17 U.S. Code 1201 – Circumvention of Copyright Protection Systems
5
National Association of Attorneys General. Cybercrimes
6
Cybersecurity and Infrastructure Security Agency. BOD 20-01: Develop and Publish a Vulnerability Disclosure Policy
7
GitHub Docs. GitHub Bug Bounty Program Legal Safe Harbor
8
HackerOne Help Center. Gold Standard Safe Harbor Statement