A charge that turns your own keyboard against you
If agents have seized your laptop or phone, or if an indictment says you committed computer fraud, the shock is natural. Ordinary life runs through computers. Work logins, shared passwords, admin panels, customer databases, and late night curiosity can all look sinister once the government frames them as hacking. Start with our overview of federal white collar defense for the full picture, then use this page for the charge itself.
This law has many rooms. Some punish spying, some punish snooping, some punish fraud, and some punish breaking things. Which room you are in decides the maximum prison time and the guideline that sets your range. Nothing below predicts what will happen in your case. The penalties described here are statutory maximums and guideline ranges, not forecasts. The facts of a case change everything.
What § 1030 actually covers
The statute, 18 U.S.C. section 1030, is titled fraud and related activity in connection with computers. Subsection (a) lists seven numbered forms of the offense. In plain terms they cover obtaining national security information, obtaining information by breaking in, trespassing on government computers, committing fraud through a computer, causing damage to computers, trafficking in passwords, and threatening or extorting through computers. Attempts and conspiracies are punished the same as the completed offense, because the statute says "Whoever conspires to commit or attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section."
Three of the seven do most of the work in real cases. Paragraph (a)(2) punishes intentionally getting information from a computer after breaking in or going past your access. Paragraph (a)(4) is the fraud paragraph, and it is the closest thing to a charge of computer fraud in the everyday sense. Paragraph (a)(5) punishes knowingly causing damage, including ransomware style attacks and destructive intrusions. The other paragraphs still matter, especially password trafficking and threats, but most indictments name one of these three.
The exact words that matter most
The fraud paragraph reads in the words of the statute. It punishes anyone who acts "knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value." Every word in that sentence does work. Knowingly sets the mental state. Intent to defraud means aiming to cheat someone, not merely bending a rule. Without authorization or beyond its limits sets the access question. Furthers the fraud plus obtains something of value means the access must connect to cheating that paid off.
The phrase exceeds authorized access has its own statutory definition, and it is the most litigated sentence in the whole law. It "means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." Notice the structure. You start with permission to be on the machine. Then you take information you have no right to take that way. The fight in every case is over what counts as information you had no right to take.
Then there is the question of which computers count. The law protects a defined term called a protected computer, and the definition is broad. It includes computers used by banks or the government where the offense affects that use. It also includes any computer "used in or affecting interstate or foreign commerce or communication." In practice that last phrase reaches any computer connected to the internet, including a home laptop and a phone. If your case involves an online system, expect the government to say the jurisdictional piece is satisfied, and expect the real fight to be about authorization instead.
What the government must prove
Take the fraud paragraph as the example, since it is the charge most clients mean when they say computer fraud. The government must prove each piece beyond a reasonable doubt. First, that you accessed a protected computer. Second, that you did so without authorization or beyond the boundaries of the access you were given. Third, that you acted knowingly and with intent to defraud. Fourth, that the access furthered the intended fraud. Fifth, that you obtained something of value. Miss any one of these and the fraud charge fails, though a different paragraph or a different statute may still be charged.
The information paragraph, (a)(2), is simpler and in some ways broader. It needs intentional access without authorization or beyond its limits, plus obtaining information. It does not need proof of a fraud scheme. That makes it a common fallback count. The damage paragraph, (a)(5), needs proof you knowingly sent a program, code, or command and intentionally caused damage without authorization, or that you intentionally broke in and recklessly caused damage, or that you intentionally broke in and caused damage plus loss. Damage itself is defined as "any impairment to the integrity or availability of data, a program, a system, or information." Deleted files, encrypted drives, altered records, and systems knocked offline all fit comfortably inside that definition.
Department policy adds a practical proof burden on top of the legal one. Prosecutors handling these cases are told they must be ready to prove the defendant knowingly entered a computer or an area of a computer that was off limits, and not merely that the defendant later misused information that was properly reachable. They must also be ready to prove the defendant knew the facts that made the access unauthorized at the time. A vague policy nobody read, or a limit nobody communicated, makes that proof harder. Screenshots, warnings, training records, and access logs therefore matter as much as testimony about what anyone intended.
The limit the Supreme Court drew
The most important decision in this area is Van Buren v. United States, decided in 2021. A police officer ran a license plate search in a law enforcement database in exchange for money, violating a department rule that limited searches to law enforcement purposes. He used his own valid login to reach information he was otherwise allowed to see. The question was whether using permitted access for a forbidden purpose counts as exceeding authorized access. The Supreme Court said no and reversed the appeals court judgment.
The rule from the case is a gates inquiry, not a motives inquiry. A person exceeds authorized access by getting into particular areas of a computer that are closed to that person, such as files, folders, or databases that sit behind limits the person cannot cross. A person who walks through an open gate but for a bad reason has misused information, not exceeded access. In the words of the opinion, the test comes down to a "gates-up-or-down inquiry", meaning either the gate was open to you or it was not. And the opinion is explicit that the statute does not reach people who merely "have improper motives for obtaining information that is otherwise available to them."
That reading drew in part on an earlier decision from the Ninth Circuit, the federal appeals court covering the western states, which had treated the without authorization language as aimed at outsiders who use a computer with no permission at all. The Supreme Court adopted the same structure for both halves of the statute. The without authorization clause protects the computer itself from outside hackers. The exceeds authorized access clause protects closed areas inside the computer from inside hackers. Both turn on entry, not on purpose.
The practical result is large. Violating a workplace computer use policy, ignoring a website terms of service page, or checking personal messages on a work machine does not by itself turn you into a hacker under this reading. An employee who was allowed into the database but used it for personal reasons stands in a different position from an employee who guessed a coworker password or slipped into a restricted folder. The first situation is about misuse. The second is about access. Only the second fits the exceeds authorized access clause.
Computer fraud is not wire fraud
Clients often confuse this charge with wire fraud, and the confusion is understandable because many cases involve both. But the two laws punish different things, and the difference decides which defenses are available. Wire fraud punishes a scheme to defraud carried out through an interstate wire, such as an email, call, text, or money transfer sent to execute the scheme. It never asks whether you were allowed on a computer. Computer fraud punishes breaking into a protected computer or passing your access limits, and its fraud form additionally needs proof you furthered fraud and obtained something of value.
The penalties differ too. Wire fraud carries up to twenty years per count as a standard maximum, rising to thirty where a bank is affected, because the statute says a violator shall be "imprisoned not more than 20 years" and in the bank related cases "imprisoned not more than 30 years." The computer fraud paragraph for fraud carries up to five years for a first offense and up to ten for a repeat one. So a case built on deceptive emails with no hacking fits wire fraud, while a case built on breaking into accounts fits computer fraud, and a case with both can charge both. A related neighbor worth knowing is access device fraud, which targets stolen card numbers and access devices rather than computer access itself.
The penalties on paper for a § 1030 charge
Read this section as a list of ceilings. No page can predict a sentence, because loss amounts, victim counts, criminal history, and the judge all move the result.
For obtaining national security information under paragraph (a)(1), the maximum is "imprisonment for not more than ten years" for a first offense and "imprisonment for not more than twenty years" for a repeat offense. For obtaining information under paragraph (a)(2), trespassing on a government computer under (a)(3), or trafficking in passwords under (a)(6), the maximum is "imprisonment for not more than one year" for a first offense. The information offense rises to "imprisonment for not more than 5 years" where it was done for commercial advantage, to further another crime, or where the information was worth more than five thousand dollars, and repeat offenses under any of the three reach ten years.
For fraud under paragraph (a)(4) or extortion under (a)(7), the maximum is "imprisonment for not more than five years" for a first offense and ten years for a repeat one. For damage under paragraph (a)(5), the range is more graduated. Lesser damage offenses carry up to one year. Damage with the listed harms, such as loss over five thousand dollars, injury, danger to health or safety, or harm to government or medical systems, carries up to five or ten years depending on the mental state. Repeat damage offenses reach twenty years. Where the conduct causes serious bodily injury the maximum is twenty years, and where it causes death the statute allows "imprisonment for any term of years or for life."
Three further points complete the picture. First, the statute contains no mandatory minimum prison term anywhere in its penalty section, so every number above is a ceiling the judge may sentence below. Second, fines follow the general federal fine law on top of the prison ceilings, which allows "for a felony, not more than $250,000" against an individual and "for a felony, not more than $500,000" against an organization, or in the alternative "the greater of twice the gross gain or twice the gross loss." Third, prison is followed by supervised release, and the classification rules explain why. An offense carrying ten years or more but less than twenty five is "less than twenty-five years but ten or more years, as a Class C felony," and release for that class runs "for a Class C or Class D felony, not more than three years."
How the guideline sentence is calculated for a § 1030 charge
Prison time in federal court is guided by the United States Sentencing Guidelines, and our federal sentencing page walks through how judges use the resulting range. Computer fraud has an unusual feature at the very first step. The guideline index sends different parts of the statute to different guidelines. Obtaining national security information goes to section 2M3.2. Trespass on a government computer goes to section 2B2.3. Extortion goes to section 2B3.2. Attempts and conspiracies go to section 2X1.1. The information, fraud, damage, and password trafficking paragraphs go to section 2B1.1, the general fraud and theft guideline. Confirm with counsel which paragraph you are charged under before doing any guideline math, because the starting guideline changes the whole calculation. The site sentencing calculator models the fraud guideline for rough illustration only.
For cases in section 2B1.1, the starting point is low and the adjustments do the work. The base offense level is 7 where the offense of conviction carries twenty years or more, because the guideline gives level 7 where "that offense of conviction has a statutory maximum term of imprisonment of 20 years or more." Otherwise the base level is 6. Loss then drives the result. The guideline states that "Loss is the greater of actual loss or intended loss." Actual loss in plain terms "means the reasonably foreseeable pecuniary harm that resulted from the offense." Intended loss counts even where the plan was impossible, so a sting with no real victim can sentence like a real scheme. The loss table climbs in steps from no increase at small losses to thirty added levels at the very largest ones.
Computer cases have their own dedicated increases inside section 2B1.1, and these are the provisions that make this page different from every other fraud page on this site. Where the offense involved an intent to get personal information, or the unauthorized public spread of personal information, the guideline adds 2 levels. Where the case involved a system that runs a critical infrastructure, or a system used by a government body for justice, defense, or national security, it adds 2 levels. Knowing transmission of damaging code under paragraph (a)(5)(A) adds 4 levels, stated as "18 U.S.C. § 1030(a)(5)(A), increase by 4 levels." And where the offense caused a major disruption of a critical infrastructure, it adds 6 levels with a floor that raises the result to at least level 24. Victim and sophistication increases can stack on top, including 2 levels for ten or more victims and larger bumps where victims suffered serious financial hardship.
One more guideline detail is specific to this statute. For computer offenses, the application notes say actual loss includes "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment." That means forensic bills, rebuild costs, and downtime losses count toward the loss number even beyond what was stolen. Because loss is usually the largest driver of the range, the fight over which response costs truly flowed from the offense is often the fight over the sentence.
Defenses that actually arise
Every defense below flows from the elements and limits described above. None promises an outcome. Each depends on logs, documents, and the law of the circuit where the case sits.
Authorization is usually the first battle. The government must show you entered without permission or crossed into an area closed to you, not just that you broke a rule about how to use information you could already see. Shared credentials, unclear permissions, routinely ignored policies, and systems with no technical barriers all support the argument that the gate was open. The Department own charging policy reinforces this, because prosecutors are told a case may not be built on the theory that violating a contract term or a website terms page by itself exceeded access, and they must be prepared to prove the defendant knew the facts that made the entry unauthorized.
Purpose based charges are the second battle, and Van Buren is the shield. If you were allowed to see the information and the complaint is really about why you looked, the exceeds authorized access clause does not fit. Terms of service violations, embellished profiles, and personal use of a work computer are the examples the policy itself says will not be charged as exceeding access. An explicit later revocation is different, such as a clear written order telling you to stay out that you received and understood. After that kind of notice, the authorization argument gets much harder.
Good faith security research is a third path, and it comes from Department policy rather than the statute. Prosecutors are told they should decline cases where the evidence shows the conduct was genuine safety testing, which the policy describes in substance as testing to find and fix flaws, done in a way designed to avoid harm, with the results used to improve safety. Testing that shades into extortion, theft, or destruction is not protected. Because this is a charging policy and not a right, researchers should get advice before testing and should preserve records showing the purpose and care behind the work.
Value and harm thresholds supply a fourth set of arguments. The fraud paragraph has a built in floor for pure use cases, because obtaining only the use of the computer worth five thousand dollars or less in a year falls outside it. The damage paragraph needs real damage and loss, not just unauthorized wandering. Where the government leans on response costs to inflate loss, each invoice can be tested for reasonableness and connection to the offense. And intent remains contestable throughout, because curiosity, mistake, and ambiguous permission all cut against proof that you knowingly crossed a line you understood.
What to do now
If the FBI or another agency is involved, assume the technical evidence is already being preserved. Logs, backups, provider records, and device images do not disappear because you deleted an app. Do not try to fix the situation by wiping devices, contacting witnesses, or explaining yourself to agents. Wiping looks like consciousness of guilt and can add charges. Talking supplies the intent evidence prosecutors need most.
Get a lawyer before you produce anything or sit for any interview. Bring every document about your access, including offer letters, permission emails, training slides, policies you signed, and any message telling you to stay out of a system. Write down privately, for your lawyer only, everyone who shared credentials with you and every administrator who knew how you used the system. Then let counsel test authorization, purpose, value, and loss the way this page describes, against the actual evidence rather than the worst reading of it.