18 U.S.C. 2701 prohibits specified intentional unauthorized access, or access exceeding authorization, to a facility through which an electronic communication service is provided, where the conduct obtains, alters, or prevents authorized access to a communication in electronic storage. Not every computer misuse fits those technical statutory requirements. [1]
Identify the service and the communication
The location, service, and storage status matter. Accessing a provider-hosted account can present different questions from taking a file stored only on a personal device. Other computer-crime, interception, privacy, or state laws may apply even where section 2701 does not.
Authorization is also specific. Knowing a password or having used an account in the past does not necessarily establish current permission. Conversely, the statute contains exceptions for certain provider-authorized conduct, user authorization relating to communications of or intended for that user, and specified lawful government processes. [1]
A household relationship or workplace position does not automatically settle the issue. Examine the actual consent, account ownership, scope, timing, and conduct.
Criminal penalty ranges
For specified purposes such as commercial advantage, malicious destruction, private commercial gain, or furthering a criminal or tortious act, the first-offense maximum is five years and a subsequent qualifying offense can carry ten. Other first offenses generally carry up to one year, with a higher repeat-offense range under the statutory conditions. [1]
Those ranges are not a prediction of the eventual sentence. Other charges, loss, individual conduct, and the applicable sentencing framework can matter.
Separate civil remedies
Section 2707 authorizes civil relief for qualifying violations under its own requirements, defenses, damages provisions, and limitations period. A criminal allegation does not automatically establish a successful civil claim, and a private settlement does not erase every possible criminal issue. [2]
Example: access after a relationship ends
A person continues logging into a former partner’s account using an old password. Preserve evidence about permission, revocation, the account and service, what was accessed, and when. Do not assume that the earlier sharing of a password authorizes all later access indefinitely.
A potential victim should secure the account through lawful means, preserve logs and messages, and avoid retaliatory access to someone else’s accounts. An accused person should not delete records or invent consent. A careful review compares the statutory definitions and exceptions with the specific system and conduct rather than relying on the broad label “hacking.”
Published personal details can raise a separate doxing issue. Destruction of records during an inquiry may involve federal obstruction law.
Primary sources
Sources checked: October 31, 2026.