Cybercrime

The short version

Cybercrime involves illegal activities done with computers or over the internet, like hacking or spreading viruses. The main federal law against these acts is the Computer Fraud and Abuse Act (CFAA), which makes it a crime to access computers without permission or to cause damage. Understanding this law helps protect you from being a victim and prevents you from accidentally breaking the law yourself.

The law this is built on

Every point below comes from the authority named next to it. Verify the current text before relying on it.

18 U.S.C. § 1030(a)
This section outlines several specific acts that are illegal, such as accessing a computer without authorization or exceeding authorized access, and obtaining information or causing damage. It makes it a crime to intentionally access a computer without permission or in a way that goes beyond the permission given.
Why it matters: This is the core federal law defining many cybercrimes and what actions are considered illegal.
18 U.S.C. § 1030(a)(2)
It is illegal to intentionally access a computer without authorization or exceed authorized access, and by doing so, obtain information from any protected computer. A 'protected computer' is one used in interstate or foreign commerce or communication, including those connected to the internet.
Why it matters: This covers common cyber activities like hacking into someone's computer or server to steal data, even if the computer isn't federal property.
18 U.S.C. § 1030(a)(5)(A), (B), (C)
It is illegal to intentionally cause damage without authorization to a protected computer. This includes knowingly transmitting a program, information, code, or command, and as a result, intentionally causing damage to a protected computer. Damage can include impairing the integrity or availability of data, programs, systems, or information.
Why it matters: This section addresses actions like spreading viruses, ransomware, or disrupting computer systems and networks.
18 U.S.C. § 1030(c)
This section details the penalties for violating the CFAA, which can range from fines and imprisonment for up to one year for a first offense, to significantly longer prison sentences (e.g., 5, 10, or 20 years) for offenses involving economic gain, significant damage, or repeat offenses.
Why it matters: Violations of the CFAA carry serious consequences, including federal prison time and large fines.

Words you need to know

Protected Computer: Under 18 U.S.C. § 1030(e)(2)(B), this means a computer used in interstate or foreign commerce or communication, including any computer connected to the internet. This broad definition covers almost all modern computers.
Without Authorization: Accessing a computer without permission from the owner or authorized user. This includes breaking into systems that require a password or other authentication.
Exceeds Authorized Access: Accessing a computer with some permission, but then using that access to get into areas or do things you were not allowed to do. For example, using your work computer access to view files unrelated to your job and that you were not permitted to see.
Damage: Under 18 U.S.C. § 1030(e)(8), this refers to any impairment to the integrity or availability of data, programs, systems, or information. This includes things like deleting files, disrupting services, or installing malware.
Intent: For many CFAA offenses, the government must prove you acted 'intentionally' or 'knowingly.' This means you meant to do the action, not that it was an accident.
Computer Fraud and Abuse Act (CFAA): The primary federal law, 18 U.S.C. § 1030, that criminalizes various forms of computer hacking and cybercrime. It aims to protect computers and data from unauthorized access and damage.

Your rights

✓You have the right to privacy and security of your personal data and computer systems, protected under laws like the CFAA.
✓If you are accused of a cybercrime, you have the right to remain silent and the right to an attorney.
✓You have the right to report cybercrimes committed against you to law enforcement, such as the FBI.
✓You have the right to expect that your employer's Acceptable Use Policy clearly defines what constitutes 'authorized access' on their systems.
✓You have the right to seek civil remedies if you are a victim of certain CFAA violations, as outlined in 18 U.S.C. § 1030(g).

How the process actually works

1
Cybercrime occurs
When the illegal act takes place.
Someone accesses a computer without permission, exceeds their authorized access, or causes damage to a computer system. This could be hacking, spreading malware, or stealing data.
2
Crime is discovered
Can be immediately or long after the initial act.
The victim, an internet service provider, or law enforcement identifies the unauthorized access or damage. This often happens after data is stolen, systems are down, or strange activity is noticed.
3
Report to authorities
As soon as possible after discovery.
The victim or discovering party reports the incident to federal law enforcement, such as the FBI, or local police. For federal crimes like those under the CFAA, the FBI is often the lead agency.
4
Investigation begins
After a report is made, duration varies greatly.
Law enforcement gathers evidence, which can include examining computer logs, network traffic, and digital devices. This is a complex process often requiring specialized forensic skills.
5
Charges are filed
After investigation, can take months or years.
If enough evidence is found, federal prosecutors may file charges under 18 U.S.C. § 1030 or other related statutes. The type of charge depends on the specific violation and the level of damage or information obtained.
6
Court proceedings
After charges are filed, duration varies.
The accused goes through the legal process, which can include plea bargains or a trial. If convicted, they face penalties outlined in 18 U.S.C. § 1030(c), including fines and imprisonment.

Deadlines that can end your case

Statute of Limitations (Criminal)
Generally 5 years from the date the offense was committed for most federal offenses, including those under 18 U.S.C. § 1030.
If charges are not filed within this window, the government generally loses the ability to prosecute the crime.
Statute of Limitations (Civil)
Generally 2 years for a civil action under 18 U.S.C. § 1030(g).
If a victim does not file a lawsuit within this window, they generally lose the ability to sue for damages.

Costly mistakes

✕Accessing any computer system or network without explicit permission, even out of curiosity, as this can be seen as 'without authorization' or 'exceeding authorized access' under 18 U.S.C. § 1030(a).
✕Sharing your computer login credentials with others, as this could lead to unauthorized access by someone else that you might be held responsible for.
✕Ignoring terms of service or acceptable use policies for websites, apps, or employer systems, as violating these can sometimes be interpreted as 'exceeding authorized access'.
✕Trying to 'test' the security of systems you don't own or have explicit permission to audit, which can be prosecuted as a crime.
✕Downloading or spreading malware, viruses, or ransomware, even if you don't intend to cause specific harm to a person, as this violates 18 U.S.C. § 1030(a)(5) regarding causing damage.
✕Not reporting a cybercrime promptly if you are a victim, which can make it harder for law enforcement to investigate and recover evidence.

Your checklist

Understand what 'authorized access' means for every computer system you use, including work and personal accounts.
Never share your login credentials or allow others to use your accounts on shared systems.
Always use strong, unique passwords and multi-factor authentication where available.
Keep your operating systems, software, and antivirus programs updated to protect against vulnerabilities.
Be cautious about clicking on suspicious links or downloading attachments from unknown sources.
If you believe your computer has been compromised, disconnect it from the internet and seek professional help.
Report any suspected cybercrime against you or your organization to federal authorities like the FBI or your local police.
Consult an attorney if you are ever accused of a cybercrime or if you believe you need to pursue legal action as a victim.

Common questions

What is considered a 'protected computer' under the CFAA?

A 'protected computer' is broadly defined in 18 U.S.C. § 1030(e)(2)(B) as any computer used in interstate or foreign commerce or communication. This includes virtually any computer connected to the internet, whether it's a personal laptop, a company server, or a government system.

Can I get in trouble for just looking at someone else's files if I accidentally found a way in?

Yes. Under 18 U.S.C. § 1030(a)(2), intentionally accessing a computer without authorization and obtaining information is a crime. Even if you stumbled upon a vulnerability, actively obtaining information without permission can lead to legal issues. The key is the 'intentional access' part.

What's the difference between 'without authorization' and 'exceeding authorized access'?

'Without authorization' means you never had permission to access the computer at all. 'Exceeding authorized access' means you had some permission (e.g., as an employee) but then went beyond that permission to access areas or information you were not allowed to see, as covered in 18 U.S.C. § 1030(a). Both are illegal under the CFAA.

What kind of penalties do cybercrimes carry?

Penalties for CFAA violations vary widely based on the specific offense, the amount of damage caused, and whether it's a first or repeat offense, as detailed in 18 U.S.C. § 1030(c). They can range from a fine and up to one year in prison for a misdemeanor, to fines and up to 20 years in federal prison for more severe felonies involving serious damage or intent to defraud.

What should I do if my computer is hacked or I'm a victim of a cyberattack?

If you are a victim of a cyberattack, you should disconnect your computer from the internet, preserve any evidence, and report the incident to federal law enforcement, such as the FBI, through their Internet Crime Complaint Center (IC3). You may also want to consult with a cybersecurity professional and an attorney.

How this changes by state

While the Computer Fraud and Abuse Act (CFAA) is a federal law, many states also have their own cybercrime laws. These state laws can cover similar offenses like unauthorized computer access or data theft, but their definitions, penalties, and specific types of prohibited conduct might differ. For example, a state law might have a lower threshold for what constitutes 'damage' or include offenses not explicitly covered by the CFAA. To find your state's specific laws, you can search your state's legislative website for terms like 'computer crime,' 'cybercrime,' or 'computer trespass.' Consulting a local attorney is the best way to understand the specifics of cybercrime laws in your state.

When you need a lawyer

You need a lawyer immediately if you are contacted by law enforcement regarding a potential cybercrime investigation or if you are charged with a cybercrime under the CFAA or state law. If you are a victim of a significant cyberattack and want to explore civil legal options to recover damages, a lawyer can help. Also, if you work in an industry with strict data security regulations and experience a breach, legal counsel can guide you through compliance and reporting requirements.

Do this today

→Review your employer's Acceptable Use Policy regarding computer systems and data.
→Implement strong passwords and multi-factor authentication for all your online accounts.
→Be skeptical of unsolicited emails, links, and downloads to protect yourself from malware.
→Familiarize yourself with where and how to report a cybercrime to federal authorities like the FBI's IC3 if you become a victim.

This lesson is legal information for educational purposes only, based on 18 U.S.C. § 1030 (CFAA). It is not legal advice and does not create an attorney-client relationship.