Trespassing in Cyberspace: The Law of Federal Cybercrime

This article describes events as reported in early 2018. The law and the cases may have changed since then.

If you or someone you love is under investigation or charged for hacking, phishing, or another computer crime, the Computer Fraud and Abuse Act is likely at the center of the case. Below, we use the "Celebgate" iCloud case to explain what that law covers, what other federal laws reach crimes committed online, and why enforcement keeps growing.

What was "Celebgate"?

"Celebgate" was the nickname for a federal cybercrime scandal that began in September 2014, when hackers obtained and leaked private photos of a number of female celebrities. As of January 2018, the FBI's investigation was still ongoing, and it had just produced another guilty plea, from George Garofano, a 26-year-old man from Connecticut.

Garofano was accused of, and admitted to, a phishing scheme that gave him access to more than 250 Apple iCloud accounts. Many of the accounts belonged to people in the entertainment business in Los Angeles.

According to the case, Garofano sent victims emails that looked like they came from Apple. The emails claimed Apple needed to verify their security and asked victims to send their usernames and passwords, or to type them into a third-party website. Either way, the information went back to Garofano. He then used it to log into the victims' iCloud accounts without permission and took personal information, private photos, and videos.

Garofano pleaded guilty to violating the Computer Fraud and Abuse Act, one of the main laws used against federal cybercrime today.

What is the Computer Fraud and Abuse Act (CFAA)?

The Computer Fraud and Abuse Act, at 18 U.S.C. § 1030, is a federal law that makes it a crime to attack or misuse computer systems. It protects federal government computers, bank computers, and any computer used in or affecting interstate or foreign commerce or communication (§ 1030(e)(2)). In practice, that includes almost any computer connected to the internet. The key is that there is some federal connection, or that the computer crime affects interstate or foreign commerce. The law aims to protect computers from trespassing, threats, damage, and spying, and from being used as tools of fraud.

The law reaches a lot of conduct. Congress passed it to fill gaps left by other federal criminal laws. Its first part, § 1030(a), makes it a crime to:

• Hack, or "trespass," into a computer system without permission.
• Damage a computer by installing a virus, worm, Trojan horse, time bomb, or similar malware.
• Use a hacked computer to commit fraud, such as using data stolen from a hacked computer to pose as another person.
• Traffic in stolen passwords.
• Use a computer to commit espionage, meaning getting national security information without permission.
• Threaten to damage a computer or leak its data to get money.

The next part, § 1030(b), makes it a crime to attempt or conspire to commit any of these crimes, with the same penalties as the completed crime. Section 1030(c) sets the penalties. They range from up to 1 year in prison for a minor first-time computer trespass to a maximum of life in prison when a hacking crime causes a death. Finally, § 1030(g) lets victims of these crimes sue for damages in civil court in some cases.

Federal cyber crimes: charges and penalties

What other federal laws cover crimes committed online?

The CFAA is the main federal law used against cybercrime, but many other federal laws also reach crimes committed online. Most are criminal laws. Others, marked below, are mainly civil or regulatory laws that can also carry criminal penalties in some cases. They include:

• Unlawful access to stored communications, such as email, 18 U.S.C. § 2701.
• Unfair or deceptive acts or practices, 15 U.S.C. § 45 (part of the Federal Trade Commission Act; mainly enforced through civil actions).
• Fraudulent use of credit cards, 15 U.S.C. § 1644.
• Mail fraud, 18 U.S.C. § 1341.
• Wire fraud, 18 U.S.C. § 1343.
• Bank fraud, 18 U.S.C. § 1344.
• Money laundering, 18 U.S.C. § 1956.
• Sexual exploitation and other abuse of children, 18 U.S.C. § 2251 and related laws such as § 2252A.
• Federal Food, Drug, and Cosmetic Act, 21 U.S.C. § 301 and following (for example, selling misbranded drugs online).
• Drug abuse prevention and control, 21 U.S.C. § 801 and following, including § 822 (for example, selling controlled substances online).
• Interstate Horseracing Act, 15 U.S.C. § 3001 and following (mainly civil; regulates off-track betting across state lines).
• Sending gambling information across state lines, 18 U.S.C. § 1084.
• Criminal copyright infringement, 17 U.S.C. § 506.
• Aggravated identity theft, 18 U.S.C. § 1028A.

Using a computer to commit a crime does not automatically add a CFAA charge. But if the government says a computer was accessed without permission along the way, you may face both a CFAA charge and a charge for the underlying crime. For example, if someone hacks into a computer to move money as part of money laundering, prosecutors may charge both the CFAA violation and money laundering.

Why is federal cybercrime enforcement growing?

Whether it is Celebgate or another federal cybercrime investigation, law enforcement is trying to keep up with hackers who keep getting more sophisticated. Their schemes include phishing, information theft, cyberstalking, malicious mischief, and planting malware and viruses.

As of 2018, the international debate over alleged Russian hacking connected to the 2016 U.S. presidential election showed how much harm cybercrime can do. Computers are likely to play a part in more and more crimes, in this country and around the world.

What should you do next?

Book a consultation to talk it through with Brandon Sample.

Book a consultation