Federal Cyber Crimes

If you or someone you love has been accused of a federal cyber crime, such as hacking, computer fraud, or ransomware, here is what the charges mean and what penalties they carry. Cyber crimes are also called computer crimes or network crimes. All of these terms mean crimes that involve computers or computer networks.

Federal cyber crime laws carry steep fines and serious prison time. They cover a long list of offenses and can be hard to understand on your own. Knowing the basic types of cyber crime, and the penalties you could face, is a good starting point for thinking about your defense. Criminal Center defends people accused of federal cyber crimes and can work with you or your loved one on a defense strategy.

Why are cyber crimes charged in federal court?

Cyber crimes often become federal cases because they involve the internet. The internet is treated as a channel of interstate and foreign commerce, so Congress can pass laws against these crimes and federal prosecutors can bring the cases.

The main federal law, the Computer Fraud and Abuse Act (CFAA), protects what it calls a "protected computer." Under 18 U.S.C. § 1030(e)(2), that includes government and bank computers and any computer used in or affecting interstate or foreign commerce or communication. Because so much computer use crosses state lines, many hacking and computer-fraud cases can be brought in federal court. If the conduct truly stayed within one state and had no other federal connection, it would be left to state prosecutors. Many of these crimes can also be charged under state law.

What types of cyber crime does federal law cover?

The CFAA, at 18 U.S.C. § 1030, covers computer-related crimes, including computer fraud. It is fairly broad, but some crimes involving computers fall outside it and are charged under other fraud laws instead. The CFAA lists seven main subsections of crimes, § 1030(a)(1) through (a)(7). Because the damage subsection, § 1030(a)(5), has three parts, the full list has nine kinds of conduct:

• Obtaining national security information: getting national defense or other restricted information from a computer without permission and passing it on, § 1030(a)(1).
• Accessing a computer and obtaining information: accessing a computer without permission, or going beyond your permission, to get information, § 1030(a)(2).
• Trespassing in a government computer: accessing a non-public federal government computer without permission, § 1030(a)(3).
• Accessing a computer to defraud and obtain value: accessing a protected computer to commit fraud and getting something of value, § 1030(a)(4).
• Intentionally damaging by knowing transmission: knowingly sending code or commands, such as malware, that intentionally damage a computer, § 1030(a)(5)(A).
• Recklessly damaging by intentional access: breaking into a computer and recklessly causing damage, § 1030(a)(5)(B).
• Negligently causing damage and loss by intentional access: breaking into a computer and causing damage and loss, § 1030(a)(5)(C).
• Trafficking in passwords: trafficking in passwords or similar access information with intent to defraud, § 1030(a)(6).
• Extortion involving computers: threatening to damage a computer or expose its data to get money, often called ransomware or cyber extortion, § 1030(a)(7).

Attempting or conspiring to commit any of these crimes is also covered. Under § 1030(b), an attempt or conspiracy carries the same penalties as the completed crime. If you are under investigation for, or charged with, any of these crimes, talk to a lawyer as soon as possible.

What if you were allowed to use the computer? ("Exceeds authorized access")

Many cases turn on what you were allowed to access. In Van Buren v. United States (2021), the Supreme Court held that you "exceed authorized access" when you get into parts of a computer, such as files, folders, or databases, that are off-limits to you. Misusing information you were allowed to see is not enough under that part of the law.

How long does the government have to bring cyber crime charges?

Yes. The statute of limitations is the deadline for bringing charges. For most federal crimes, including most CFAA charges, the government must indict within 5 years of the crime (18 U.S.C. § 3282). If the government waits longer than that, the charge may be barred. There are exceptions. For example, certain computer crimes that are also listed as federal terrorism offenses have an 8-year limit (18 U.S.C. § 3286). If you think the deadline may have passed in your case, have a lawyer check the dates and raise this defense.

What are the penalties for federal cyber crimes?

The penalties are set in 18 U.S.C. § 1030(c). They are statutory maximums set by Congress, not sentencing guideline recommendations. The maximum depends on which part of § 1030 is charged and whether you have a prior computer-crime conviction. For a first offense:

• Unauthorized access to get information: up to 1 year, or up to 5 years if done for commercial advantage or private financial gain, to further another crime, or if the information is worth more than $5,000.
• Government-computer trespass or password trafficking: up to 1 year.
• Computer fraud or cyber extortion: up to 5 years.
• Recklessly causing damage after breaking in: up to 5 years in the more serious cases.
• Knowingly sending malware or commands that cause damage: up to 10 years in the more serious cases.
• National security information: up to 10 years.
• Damage that causes, or tries to cause, serious bodily injury: up to 20 years. Death: up to life in prison.

For someone with a prior computer-crime conviction, the maximums go up, in some cases to 20 years. Keep in mind that these are limits, not the likely sentence. The judge also uses the U.S. Sentencing Guidelines, where the dollar amount of the loss often drives the range.

Prosecutors often add other charges, such as wire fraud (18 U.S.C. § 1343) or aggravated identity theft (18 U.S.C. § 1028A), which adds a mandatory 2 years that must be served after the other sentence.

Can victims sue, and what about fines?

Fines can be added to any sentence. The amount often depends on how much damage the crime caused and how much the offender gained. The court can also order restitution, meaning repayment to victims.

Under 18 U.S.C. § 1030(g), a person who suffers damage or loss can also bring a civil lawsuit against the offender in some cases. It generally must be filed within 2 years of the act or the discovery of the damage. Any civil judgment would be on top of any criminal fines, so a lawyer should look at both the criminal case and any civil exposure.

More on federal cybercrime laws

What should you do next?

Book a consultation to talk it through with Brandon Sample.

Book a consultation