What the Computer Fraud and Abuse Act Covers

The Computer Fraud and Abuse Act (CFAA) is the main federal computer-crime law. It is codified at 18 U.S.C. § 1030. It covers hacking, computer fraud, damage to computers, password trafficking, and extortion involving computers.

If you, or someone you are helping, has been accused of a federal cyber crime, the sections below explain the statute subsection by subsection, the penalties in § 1030(c), and how long the government has to bring charges. Criminal Center defends people accused of federal cyber crimes.

When was the Computer Fraud and Abuse Act passed?

Congress added 18 U.S.C. § 1030 on October 12, 1984 (Pub. L. 98-473) and amended it on October 16, 1986 (Pub. L. 99-474). The statute’s source credit also lists later amendments, including Pub. L. 103-322 (September 13, 1994), Pub. L. 104-294 (October 11, 1996), Pub. L. 107-56 (October 26, 2001), Pub. L. 110-326 (September 26, 2008), and Pub. L. 116-179 (October 20, 2020).

Why are cyber crimes charged in federal court?

Cyber crimes often become federal cases because they involve the internet. The internet is treated as a channel of interstate and foreign commerce, so Congress can pass laws against these crimes and federal prosecutors can bring the cases.

The main federal law, the Computer Fraud and Abuse Act (CFAA), protects what it calls a "protected computer." Under 18 U.S.C. § 1030(e)(2), that includes government and bank computers and any computer used in or affecting interstate or foreign commerce or communication. Because so much computer use crosses state lines, many hacking and computer-fraud cases can be brought in federal court. If the conduct truly stayed within one state and had no other federal connection, it would be left to state prosecutors. Many of these crimes can also be charged under state law.

What types of cyber crime does federal law cover?

The CFAA, at 18 U.S.C. § 1030, covers computer-related crimes, including computer fraud. It is fairly broad, but some crimes involving computers fall outside it and are charged under other fraud laws instead. The CFAA lists seven main subsections of crimes, § 1030(a)(1) through (a)(7). Because the damage subsection, § 1030(a)(5), has three parts, the full list has nine kinds of conduct:

• Obtaining national security information: getting national defense or other restricted information from a computer without permission and passing it on, § 1030(a)(1).
• Accessing a computer and obtaining information: accessing a computer without permission, or going beyond your permission, to get information, § 1030(a)(2).
• Trespassing in a government computer: accessing a non-public federal government computer without permission, § 1030(a)(3).
• Accessing a computer to defraud and obtain value: accessing a protected computer to commit fraud and getting something of value, § 1030(a)(4).
• Intentionally damaging by knowing transmission: knowingly sending code or commands, such as malware, that intentionally damage a computer, § 1030(a)(5)(A).
• Recklessly damaging by intentional access: breaking into a computer and recklessly causing damage, § 1030(a)(5)(B).
• Negligently causing damage and loss by intentional access: breaking into a computer and causing damage and loss, § 1030(a)(5)(C).
• Trafficking in passwords: trafficking in passwords or similar access information with intent to defraud, § 1030(a)(6).
• Extortion involving computers: threatening to damage a computer or expose its data to get money, often called ransomware or cyber extortion, § 1030(a)(7).

Attempting or conspiring to commit any of these crimes is also covered. Under § 1030(b), an attempt or conspiracy carries the same penalties as the completed crime. If you are under investigation for, or charged with, any of these crimes, talk to a lawyer as soon as possible.

What if you were allowed to use the computer? ("Exceeds authorized access")

Many cases turn on what the person was allowed to access. In Van Buren v. United States, 593 U.S. 374 (2021), the Supreme Court held that a person “exceeds authorized access” under § 1030(a)(2) when he has authorized access to a computer but then obtains information in particular areas of it, such as files, folders, or databases, that are off-limits to him. Misusing information the person was allowed to obtain is not enough.

How long does the government have to bring cyber crime charges?

The limit is generally five years. For a non-capital offense, the government must bring the charge within five years unless another statute says otherwise (18 U.S.C. § 3282). That five-year limit is not absolute for every computer crime. Section 1030(a)(1), and § 1030(a)(5)(A) resulting in damage defined in § 1030(c)(4)(A)(i)(II) through (VI), are listed in § 2332b(g)(5)(B). Under 18 U.S.C. § 3286, those offenses have an eight-year limit, or no limit if the offense resulted in, or created a foreseeable risk of, death or serious bodily injury.

What are the penalties for federal cyber crimes?

The penalties are set in 18 U.S.C. § 1030(c). They are statutory maximums, not sentencing guideline recommendations. The maximum depends on which subsection is charged and on whether there is a prior conviction under § 1030. The figures below are the statute’s own maximums:

• § 1030(a)(1), first offense: up to 10 years. After another conviction under § 1030: up to 20 years (§ 1030(c)(1)).
• § 1030(a)(2), (a)(3), or (a)(6), first offense: up to 1 year. An (a)(2) offense for commercial advantage or private financial gain, in furtherance of another crime or tort, or involving information worth more than $5,000: up to 5 years. After another § 1030 conviction: up to 10 years (§ 1030(c)(2)).
• § 1030(a)(4) or (a)(7), first offense: up to 5 years. After another § 1030 conviction: up to 10 years (§ 1030(c)(3)).
• § 1030(a)(5)(A) that causes a harm listed in § 1030(c)(4)(A)(i)(I) through (VI), first offense: up to 10 years. The parallel (a)(5)(B) offense: up to 5 years. A later (a)(5)(A) or (a)(5)(B) conviction: up to 20 years (§ 1030(c)(4)).
• Serious bodily injury from conduct in violation of § 1030(a)(5)(A): up to 20 years. Death from that conduct: any term of years or life (§ 1030(c)(4)(E) and (F)).

These are maximums, not the sentence a judge must impose. The judge also consults the U.S. Sentencing Guidelines, where the loss amount often affects the range under USSG §2B1.1. That guideline is among the provisions amended effective November 1, 2026, so the manual in effect on the sentencing date controls.

Prosecutors often add other charges, such as wire fraud (18 U.S.C. § 1343) or aggravated identity theft (18 U.S.C. § 1028A), which adds a mandatory 2 years that must be served after the other sentence.

Can victims sue, and what about fines?

Fines can be added to any sentence. The amount often depends on how much damage the crime caused and how much the offender gained. The court can also order restitution, meaning repayment to victims.

Under 18 U.S.C. § 1030(g), a person who suffers damage or loss from a violation may sue for compensatory damages and injunctive or other equitable relief, but only if the conduct involves one of the factors in § 1030(c)(4)(A)(i)(I) through (V), and only if the suit begins within two years of the act or the discovery of the damage.

More on federal cybercrime laws

Charged under the CFAA? Our federal computer fraud defense pageThat page is the defense guide. This page stays with what the statute says.

What should you do next?

Book a consultation and tell us what happened.

Book a consultation