Cybercrime Laws in the United States by Federal Statute

Federal cybercrime law in the United States is a system of distinct statutes. Understanding it means knowing what each law covers, where its limits lie, and which laws apply together. For practitioners and security professionals, the central lesson is simple. The incident supplies the facts, but the statutory map determines the legal exposure.

Why the United States has no single cybercrime code — and why that matters for practitioners

CRS R47557 explains that federal law has no single, straightforward definition of cybercrime. Depending on the context, the term can mean all crimes involving computers, crimes targeting computers, or crimes unique to computing. That shifting definition reflects a layered assembly of laws aimed at particular conduct, systems, and data. “Cybercrime” is the sign above the building.

Each statute thus has its own jurisdictional hooks, rules on the intent that must be shown, and penalties. The same incident can implicate several laws, while conduct that sounds like cybercrime may fail to satisfy a particular statute’s elements. Knowing which statute fits a given fact pattern is the foundational skill.

The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, what it actually prohibits

The CFAA is the broadest and most frequently invoked federal cybercrime statute, but it does not prohibit “hacking” as one undifferentiated offense. CRS 97-1025 describes it as filling “cracks and gaps” in other federal criminal law. It protects federal computers, bank computers, and internet-connected computers from several kinds of misuse. Its seven categories under § 1030(a) require separate attention because the conduct covered by one is not interchangeable with another.

Section 1030(a)(1) addresses accessing a computer to commit espionage. Section 1030(a)(2) prohibits obtaining certain information through unauthorized computer access. Section 1030(a)(3) covers trespassing in a government computer, and § 1030(a)(4) covers fraud through unauthorized computer access. Section 1030(a)(5) covers knowingly causing damage to a protected computer through transmission of a program, information, code, or command, including worms, viruses, Trojan horses, and denial-of-service attacks. Section 1030(a)(6) addresses trafficking in passwords for a government computer or affecting interstate commerce, while § 1030(a)(7) covers threats to damage a protected computer.

The definition of “protected computer” supplies much of the statute’s reach. It includes computers used in or affecting interstate or foreign commerce, which in practice encompasses virtually any internet-connected device. Section 1030(b) separately makes attempts and conspiracies to commit CFAA offenses criminal. Penalties under § 1030(c) range from not more than one year for simple unauthorized trespass to a maximum of life imprisonment when an offender knowingly or recklessly causes death through intentional computer damage. Section 1030(g) also creates a civil cause of action for persons suffering damage or loss, giving private parties an enforcement path separate from prosecution. Sections 1030(i) and (j) authorize forfeiture of tainted property.

How courts have drawn the CFAA’s boundaries — “unauthorized access” and the Van Buren rule

The statute’s reach depends heavily on what courts understand unauthorized access to mean. In Van Buren v. United States, the Supreme Court adopted a “gates-up-or-down” approach. The CFAA does not cover someone who accesses information they are entitled to access merely because they do so for an improper purpose.

The Third Circuit applied that principle in NRA Group, LLC v. Durenleau on Aug. 26, 2025, amended Oct. 7, 2025. Absent evidence of code-based hacking, it rejected CFAA claims based on current employees’ breaches of workplace computer-use policies and affirmed summary judgment for those employees. But Van Buren left open whether breaking terms of service can ever count as unauthorized access. In Ryanair DAC v. Booking Holdings (2025), a federal district court suggested that access using valid credentials might fall within the CFAA after the website owner sends a cease-and-desist letter. That unsettled edge matters for web scraping, credential sharing, and automated data collection, making judicial interpretation essential context.

The limits of CFAA enforcement — DOJ charging policy for security researchers and the statute’s civil exposure gap

DOJ’s good-faith security research policy is a charging policy that limits how prosecutors use the CFAA without rewriting the statute. Its protection concerns criminal prosecution and does not foreclose private litigation under § 1030(g). A company that believes research caused damage or loss may still sue, regardless of DOJ’s position. A prosecution policy is not an invisibility cloak for civil liability.

The Electronic Frontier Foundation has documented the CFAA’s chilling effect on security research and journalism. Under its broad terms, researchers who find unexpected access paths can face felony charges even without malicious intent, and first-time offenders can be charged with a felony. The operational distinction is therefore between what the text permits, what prosecutors will charge, and what private parties may pursue. Security professionals and their counsel must account for all three, rather than treating prosecutorial restraint as comprehensive protection.

The Electronic Communications Privacy Act, 18 U.S.C. §§ 2510–3127, three titles covering transit, storage, and metadata

Where the CFAA focuses on computer misuse, ECPA governs communications privacy through three interlocking titles. ECPA coverage depends on the state and type of communication involved. Transit, storage, and metadata are separate legal categories. As a result, the same intrusion can implicate different provisions depending on what was captured or accessed.

Title I, the Wiretap Act, §§ 2510–2523, covers communications in transit. Unauthorized interception of a wire, oral, or electronic communication is a federal felony carrying up to five years’ imprisonment, with each interception treated as a separate offense for penalty purposes. Title II covers communications accessed from storage. Title III, the Pen Register/Trap-and-Trace statute, §§ 3121–3127, covers metadata such as numbers dialed and routing information. It requires a court order but applies a lower legal standard than a wiretap order. These distinctions matter beyond government surveillance because communications interception can also create corporate and civil exposure.

ECPA as a corporate litigation risk — the class-action wave targeting website operators

An August 2025 federal court ruling opened a pathway for plaintiffs to use alleged inaccuracies in a company’s privacy policy as the basis for a federal Wiretap Act claim. That opens the door to claims over the use of pixels, cookies, and third-party analytics tools. Ordinary website analytics can supply the predicate for a claim.

The financial stakes come from the Wiretap Act’s statutory damages, which are the greater of $100 per day of violation or $10,000. Those amounts can create substantial aggregate exposure in class actions before actual harm is shown. Courts are still debating where to draw the line, and a circuit split is taking shape. On April 6, 2026, the First Circuit heard argument on whether website operators face liability under the crime-tort exception, with a decision pending. For in-house legal teams and information security leaders, this risk ties what a company says about privacy to how it uses analytics, bringing surveillance law into both.

Identity theft statutes, 18 U.S.C. §§ 1028 and 1028A, the federal identity fraud framework

Identity theft law shifts the focus again, this time to the use of another person’s identity. Section 1028, amended by the Identity Theft and Assumption Deterrence Act of 1998, covers fraud involving identification documents, authentication features, and information. It criminalizes knowingly transferring, possessing, or using another person’s means of identification with intent to commit or aid unlawful activity.

Section 1028A makes aggravated identity theft a separate offense when it is tied to a specified predicate felony. It carries a mandatory minimum two-year prison sentence consecutive to the underlying offense, making it a sentencing multiplier when charged with qualifying conduct. Prosecutors frequently add it to CFAA or wire fraud counts. DOJ’s announcement of the Rydox Marketplace case provides a concrete example of the identity-theft component. Ardit Kutleshi, 28, a Kosovar national, pleaded guilty in September 2026 to aggravated identity theft and money laundering conspiracy related to creating and operating the marketplace for stolen credentials and personal data.

Auxiliary prosecution tools — wire fraud, the Economic Espionage Act, and the reach of conspiracy statutes

Wire fraud under 18 U.S.C. § 1343 prohibits schemes to defraud using interstate wire communications, and DOJ has used it against ransomware attackers and developers. CRS R46932 identifies it as a tool applicable to ransomware prosecution. The Economic Espionage Act, 18 U.S.C. §§ 1831–1839, covers the theft of trade secrets, which can include intangible proprietary information. In cyber cases, it can reach exfiltration aimed at conveying that information to a foreign government or obtaining commercial advantage.

Participation also extends beyond the person executing an intrusion. General conspiracy under 18 U.S.C. § 371 and aiding and abetting under 18 U.S.C. § 2 help prosecutors reach developers, affiliates, and infrastructure providers, in addition to the CFAA’s own attempt and conspiracy provision. The Zeppelin ransomware indictment illustrates this layered approach. It alleged that Antropenko used ransomware to encrypt and exfiltrate victim data worldwide and demand ransom. Those allegations supported CFAA damage, wire fraud, and conspiracy counts in the same prosecution, with each charge addressing a different part of the alleged conduct.

Sector-specific and regulatory cybersecurity statutes — FISMA, HIPAA, GLBA, and the SEC disclosure rules

A separate regulatory layer imposes duties to secure systems and disclose incidents. FISMA requires federal agencies to put information security programs in place and gives the Department of Homeland Security power to oversee them through CISA. HIPAA’s Privacy Rule and Security Rule establish standards for protecting health information at covered healthcare entities and their business associates. GLBA imposes security and privacy duties on financial institutions, including safeguarding customer information and providing privacy notices. These laws concern the organization’s obligations even when someone else causes the intrusion.

The SEC Cybersecurity Disclosure Rules also require public companies to disclose material cybersecurity incidents and describe how they handle risk management and governance. Inadequate or misleading disclosure can turn a security failure into a potential securities law violation. Government contracting adds another exposure point. DOJ announced nine cybersecurity-related settlements in fiscal year 2025, a subset tied to failures to comply with DFARS 7012, which requires NIST 800-171 compliance. As part of the 2025–2026 enforcement wave, a criminal indictment charged a former senior manager at a cloud service contractor with wire fraud and major government fraud tied to false claims about FedRAMP. The dividing line is important because misrepresenting compliance can be prosecuted as fraud independently of any intrusion.

The TAKE IT DOWN Act, a new criminal prohibition on nonconsensual intimate images

The TAKE IT DOWN Act, signed May 19, 2025, creates the first federal criminal prohibition specifically targeting nonconsensual intimate images, including AI-generated deepfakes. It establishes liability outside the computer-access and communications-interception framework. Its focus is the harm caused by digital content. It therefore occupies a separate place on the federal statutory map.

In June 2026, DOJ seized the domains CFAKE.com and SOCFAKE.com after a federal judge found probable cause to believe they were being used to commit criminal violations of the Act. The procedural distinction matters, however, because a probable-cause finding supporting seizure is not a conviction.

How the statutes interlock — reading the architecture as a system, not a checklist

A ransomware attack on a healthcare organization shows how the pieces fit together. Computer damage can implicate CFAA § 1030(a)(5), while threats can implicate § 1030(a)(7) and the ransom demand can support wire fraud charges. Use of patient identity data may bring § 1028A into play if its predicate-felony requirements are met. The covered entity may also have duties under HIPAA after a breach, and FISMA can apply when federal systems are involved.

DOJ’s Computer Crime and Intellectual Property Section coordinates prosecutions that use these laws together. For practitioners, the corresponding task is to read across statutes. A limit in the CFAA is not necessarily a gap in the wider system, and criminal liability for an attacker does not resolve the victim organization’s compliance duties. Incident response, disclosure timing, ransom payment analysis, and research methodology all carry legal dimensions that cross statutory boundaries. Understanding that map is a prerequisite both to navigating it and to speaking credibly with the legally sophisticated audiences security professionals serve.