Computer Fraud and Abuse Act Defense Lawyer

Computer Fraud and Abuse Act cases rarely start with a hacker in the way the phrase suggests. They start with a departing employee who copied a customer list to a personal drive, a contractor who kept using credentials after the engagement ended, a researcher who scraped a site the owner did not want scraped, or an administrator who looked at records he had access to but no business reason to open. The statute at 18 U.S.C. § 1030 covers all of that territory, and it has both criminal and civil teeth.

The Eastern District of Virginia sees a large share of these matters. Federal agencies, defense and intelligence contractors, and a dense concentration of network infrastructure sit inside the district, and prosecutors there handle computer intrusion cases regularly. That means a matter with a northern Virginia connection can become a federal case even when everyone involved was somewhere else.

Law Offices Of SRIS, P.C. represents employees and former employees, executives, contractors, security researchers, systems administrators, and companies in Computer Fraud and Abuse Act matters, including investigations that have not yet produced a charge. To discuss a matter under the Computer Fraud and Abuse Act, call (888) 437-7747 to request a consultation.

On this page

What 18 U.S.C. § 1030 Prohibits

The statute is not a single offense. It is a group of related prohibitions built around one recurring idea: accessing a computer without authorization, or exceeding authorized access, and then doing something the statute cares about.

Those prohibitions cover obtaining information from a protected computer, obtaining national security information, accessing a computer used by a federal agency, using access to further a fraud and obtain something of value, and knowingly transmitting a program, code, or command that causes damage. The statute also reaches trafficking in passwords and similar access credentials, and extortionate demands connected to threats against a computer or to information taken from one.

Two definitions do most of the work. A protected computer is defined broadly enough that virtually any machine connected to the internet qualifies, so the jurisdictional element is rarely a real fight. Damage and loss are defined terms as well, and they carry more weight than people expect, because several theories require damage or a loss meeting a threshold that the statute sets. Those thresholds are in the statutory text and should be confirmed against the current text with counsel rather than taken from any figure quoted online.

Authorization Is Where These Cases Are Won or Lost

Almost every contested Computer Fraud and Abuse Act case turns on the phrases without authorization and exceeds authorized access. The government reads them to cover conduct that breaks the rules attached to a system. The defense reads them to cover conduct that breaks through a barrier the system actually imposed.

Courts have moved toward the narrower reading in important respects, treating the question as whether the person was entitled to reach the particular files or areas at issue rather than whether the person had a permissible purpose. Under that approach, violating an employer use policy or a website terms of service provision is not by itself a federal crime. The boundaries are still litigated, particularly where credentials were shared, where access was revoked informally, and where automated collection is involved.

This is why the technical record matters so much. Access control lists, permission changes, offboarding tickets, shared credential practices, and the actual configuration of the system at the relevant time frequently show that the access was permitted even when the purpose was disloyal. Disloyalty is a matter for employment law and for state law claims. It is not automatically a federal offense.

The Civil Side of the Same Statute

The statute also creates a private cause of action, which is why many people first encounter the statute in a lawsuit rather than in an investigation. Employers use it against departing employees alongside trade secret and contract claims, and companies use it against competitors and against people who scrape their platforms.

The civil and criminal sides interact in ways that catch defendants out. A civil complaint gives a referral file to prosecutors if they want it. Deposition testimony given in the civil case is available to the government. A settlement that includes admissions can become the centrepiece of a criminal proffer. Anyone facing a civil Computer Fraud and Abuse Act claim who might also face criminal exposure needs both risks assessed together, and sometimes needs the civil case slowed while that assessment happens.

How These Investigations Actually Run

The evidence in a computer case is unusually durable and unusually specific. Server and application logs, authentication records, endpoint forensic images, badge and VPN records, cloud storage activity, and records held by service providers and obtained through legal process together produce a timeline far more detailed than witness memory.

That cuts both ways. The same records that show a download can also show that the account was authorized, that the same behaviour was routine across a team, that a supposed intrusion was a misconfiguration, or that the timeline the government has assembled does not fit the person it has focused on. Getting a defense forensic analyst involved early, before devices are returned or images are lost, is often the difference between contesting the technical record and arguing about it.

The other early priority is the interview. Agents in computer cases often approach a person before any charge, sometimes at home and sometimes at work, and an explanation given without counsel becomes the fixed version of events. A person is not required to speak with federal agents, and false statements to them create fresh criminal exposure separate from the computer allegation.

Why So Many of These Cases Land in Virginia

Computer cases follow the data, and a great deal of data passes through northern Virginia. Federal agencies and their contractors are concentrated there, and so is a significant share of the physical infrastructure that carries and stores internet traffic. When conduct touches a server, a provider, or an agency system with a connection to the district, venue in the Eastern District of Virginia becomes available even if the person accused never set foot in the state.

That has practical consequences. A defendant may be litigating far from home, with counsel who must appear in a district known for a compressed schedule. Motions practice happens quickly, discovery deadlines arrive early, and a defense that assumes a leisurely calendar is behind before it starts. Appeals from the district go to the United States Court of Appeals for the Fourth Circuit, whose decisions on authorization and on the definitions in the statute shape how these matters are argued.

Venue itself is occasionally contestable, particularly where the only connection is a provider whose equipment happens to sit in the district. Whether that argument is available depends on the specific theory the government has chosen and on which acts it says occurred where, so it is examined early rather than assumed away.

Frequently Asked Questions

Is taking company files on the way out a federal crime?

Not automatically. If the employee had permission to reach those files, courts following the narrower reading of the statute generally hold that using them for a disloyal purpose does not make the access unauthorized. The conduct may still support trade secret claims, contract claims, and state law claims, and the analysis changes if credentials were used after access was revoked or if files were reached through areas the person was never permitted to enter.

What is a protected computer?

The term is defined in the statute very broadly, and in practice nearly any computer connected to the internet or used in interstate commerce falls inside it, including phones and cloud systems. Defendants rarely win on this element. The real fights are about authorization, about whether damage or loss as the statute defines those terms actually occurred, and about whether the person charged is the person who did the act.

Does the statute require damage to a system?

Some theories do and others do not. Obtaining information can create liability without any harm to the system, while the transmission provisions are built around damage, and certain theories depend on loss reaching a threshold set in the statutory text. Because those thresholds and definitions are technical and have been amended over time, confirm the current requirements against the current statute with counsel rather than relying on a general description.

Can security research be charged under this statute?

It has been, which is why researchers pay close attention to the authorization question. Testing conducted under a written agreement, inside a defined scope, and through a published disclosure program sits in a very different position from testing done on a system the researcher has no relationship with. The documentation of scope and permission created before the work begins is usually the most valuable evidence a researcher can have.

What if I still had valid credentials?

Valid credentials help but do not end the inquiry. The questions are whether the credentials were still authorized at the time, whether the account was entitled to reach the specific material at issue, and whether access was revoked in a way that was communicated. Informal revocation, shared accounts, and stale permissions are common in real environments, and they frequently support a defense that the access remained authorized.

Should I return the device or wipe it?

Do neither without counsel. Deleting material once a matter is anticipated can create obstruction exposure that is far more serious than the underlying allegation, and it destroys the exculpatory record at the same time. Preserve everything, stop routine deletion in writing, and let counsel handle the return of company property and any forensic imaging so that the technical record is captured before anything changes.

How Mr. Sris and the Firm’s Of Counsel Attorneys Handle Computer Fraud and Abuse Act Matters

Computer cases are decided on logs and configuration rather than on characterizations of loyalty. The early work is preserving the technical record, establishing what the system actually permitted at the relevant time, and keeping the client from supplying the narrative that the records do not.

Mr. Sris, Owner and Founder of Law Offices Of SRIS, P.C., is a former prosecutor and founded the firm in 1997. He is admitted in Virginia, Maryland, the District of Columbia, New Jersey, and New York. His background at George Mason University in accounting and information systems is applied to complex financial and technology-related cases, which is the category these matters fall into. Mr. Sris and the firm’s Of Counsel attorneys, who contract directly with the firm, work on federal criminal matters together.

The firm represents employees, contractors, researchers, administrators, and companies in Computer Fraud and Abuse Act matters, including federal investigations, charged cases, and civil claims brought under the same statute. To discuss a matter under 18 U.S.C. § 1030, call (888) 437-7747 to request a consultation.

Disclaimers

This page describes the Computer Fraud and Abuse Act at 18 U.S.C. § 1030 in general terms for people trying to understand a federal process. It is not legal advice, and reading it does not create an attorney-client relationship with Law Offices Of SRIS, P.C. Federal statutes and the decisions interpreting them change over time, so confirm anything stated here against the current statutory text with counsel before acting on it.

Every federal matter turns on facts that belong to that matter alone. Case results depend on a variety of factors unique to each case. Results may vary.

Attorney responsible for this advertising: Mr. Sris. Law Offices Of SRIS, P.C. Call (888) 437-7747 to request a consultation; the firm’s intake line is staffed 24/7.

Attorney advertising. Prior results do not guarantee a similar outcome.

A computer fraud and abuse act case is one part of fraud & financial crimes work, and our page on bank fraud defence covers the wider process.