What the Computer Fraud and Abuse Act covers
The main federal computer crime statute is 18 U.S.C. § 1030. It reaches several kinds of conduct:
- Obtaining information. Intentionally accessing a computer without authorization, or beyond authorized access, to obtain financial records, government information or data from a protected computer.
- Computer fraud. Knowingly accessing a protected computer without authorization, with intent to defraud, and obtaining something of value.
- Damage. Knowingly sending code or commands that intentionally damage a protected computer, or causing damage through unauthorized access.
- Password trafficking. Knowingly trafficking in passwords or similar access information with intent to defraud.
- Extortion. Threatening to damage a computer or take data in order to extort money or something of value.
- Government computers. Unauthorized access to nonpublic federal computers or protected national security information.
What the government has to prove
Each part of section 1030 has its own elements. Most require proof that access was without authorization or exceeded authorized access, and each requires a specific mental state, such as acting intentionally, knowingly or with intent to defraud.
Many cases also depend on dollar thresholds. Some penalties increase when the value of information exceeds $5,000, or when damage causes at least $5,000 in loss in a year.
Computer crime charges and penalties
| Charge | What it covers | Minimum prison term | Maximum prison term |
|---|---|---|---|
| 18 U.S.C. § 1030(a)(2) | Obtaining information through unauthorized access | None | 1 year; 5 if for gain, in furtherance of another crime, or over $5,000 in value |
| 18 U.S.C. § 1030(a)(4) | Computer fraud with intent to defraud | None | 5 years |
| 18 U.S.C. § 1030(a)(5)(A) | Intentionally damaging a protected computer, with harms listed in the statute | None | 10 years |
| 18 U.S.C. § 1030(a)(7) | Computer-related extortion | None | 5 years |
| Aggravated identity theft, 18 U.S.C. § 1028A(a)(1) | Using another person’s means of identification during and in relation to certain felonies | 2 years, consecutive | 2 years in addition to the underlying sentence |
These are maximums for a first offense. Higher maximums apply in some circumstances, including repeat offenses.
Aggravated identity theft
Section 1028A applies when a person, during and in relation to a listed felony, knowingly transfers, possesses or uses another person’s means of identification without lawful authority. The listed felonies include federal fraud and false statement crimes and mail, bank and wire fraud.
The sentence is two years on top of the sentence for the underlying felony. A court cannot impose probation, and the two-year term generally cannot run at the same time as other sentences.
An aggravated identity theft count adds two years that cannot be served at the same time as the main sentence.
How these cases usually unfold
- Records requestsAgents obtain account, login and payment records from service providers.
- Search and seizurePhones, computers and storage devices are seized under warrants.
- Forensic reviewDevices are imaged and analyzed, which can take months.
- ChargesProsecutors file computer fraud counts, often with wire fraud or identity theft counts.
- Plea or trialThe case resolves by agreement, by motion or in front of a jury.
Where these cases are often defended
Every case turns on its own facts. Issues that frequently matter include:
- Authorization. Whether the person was actually allowed to access the system or data.
- Attribution. Whether the government can prove who was using the account or device at the time.
- Intent. Whether the person acted with the mental state the specific charge requires.
- Loss figures. How the government calculated loss, damage and value, including the $5,000 thresholds.
- The search. Whether warrants for devices and accounts were valid and properly limited.
How Kaufman Legal Group can help
Jason Kaufman has tried more than 90 cases and is a Criminal Justice Act panel attorney in the Southern District of Florida. He works with Phil Horowitz, who has practiced criminal defense since 1985 and spent decades on the CJA panel in the Southern and Middle Districts of Florida, and Victor E. Rocha, who was admitted to The Florida Bar in 1983, practices in federal courts including the Eleventh Circuit and the Southern District of Florida, and speaks Spanish. Together they bring more than 100 years of combined experience.
In computer crime cases, the team reviews the digital evidence and how it was collected, tests the government’s loss numbers and prepares the case for trial. The first consultation is free and confidential.