18 U.S.C. 1030, the Computer Fraud and Abuse Act, covers several computer-related offenses, including specified unauthorized access, fraud, damage, password trafficking, and extortion. It does not make every breach of a website’s terms or workplace computer policy a federal crime. [1]
Access and misuse are different questions
Determine what computer or information the person was entitled to access and what technical or permission boundary was crossed. Having authorized access but using information for an improper purpose is not automatically equivalent to accessing off-limits information. DOJ’s published charging guidance addresses these distinctions and good-faith security research, but charging policy is not a private license to test any system. [2]
Penalty and civil rules vary
Different subsections require different mental states and additional facts, and penalties depend on the offense and enhancements. The civil remedy in subsection (g) also has specified injury, statutory-factor, and time-limit requirements. Not every inconvenience supports a CFAA damages claim. [1]
Preserve technical evidence
Keep authorization records, access logs, permission changes, incident timelines, and support for claimed loss or damage. Distinguish restoration costs from unrelated business losses.
For example, an account holder entering a restricted database presents a different issue from downloading information the account was allowed to view.
Distinguish qualifying loss from every downstream expense
For a civil claim, identify the particular subsection(g) factor relied on. A commonly litigated factor concerns qualifying loss of at least$5,000 during a one-year period, but it is not the only statutory factor and should not be turned into a universal threshold for every CFAA claim. The statute defines loss and damage separately. Ordinary litigation expense or an unrelated business disappointment should not simply be labeled computer loss. The civil time limit generally concerns two years from the act or discovery of damage under the text. Record the relevant event and discovery dates rather than relying on an indefinite “investigation ongoing” assumption. A technical incident report should explain unauthorized access, resulting impairment, response work, and the legal basis for claimed costs as separate parts of the analysis. [1]
See stored-communications access and government searches of business systems for separate statutes and constitutional rules.
Primary sources
- 18 U.S.C. 1030
- Department of Justice Announces New Policy for Charging Cases Under the Computer Fraud and Abuse Act
Sources checked: October 31, 2026.