Computer Fraud and Abuse Act Elements of the Offense

The Computer Fraud and Abuse Act is a collection of separate offenses rather than one. Each provision of 18 U.S.C. § 1030 has its own elements, and a case tried in the Eastern District of Virginia is presented to the jury under Fourth Circuit law. Identifying which provision the government has actually charged is the first task in any defense, because the elements differ enough that evidence fatal to one theory is irrelevant to another.

What the provisions share is an access requirement and a computer requirement. What they do not share is the consequence each one demands. To discuss the elements at issue in a Computer Fraud and Abuse Act matter, call (888) 437-7747 to request a consultation.

On this page

The Shared Elements

Every theory requires access to a computer either without authorization or exceeding authorized access. Courts have increasingly read that requirement as a question of entitlement, asking whether the person was permitted to reach the particular files or areas at issue rather than whether the purpose was proper.

Every theory also requires that the machine fall within the statutory definition of a protected computer. That definition is written broadly enough that most internet connected systems qualify, including phones and cloud services, so the element is seldom contested successfully. Several provisions add a mental state requirement, most often that the access was intentional, and some require that the defendant acted knowingly with respect to a further consequence.

The Elements That Differ by Provision

Beyond access, the provisions diverge. One group is complete once information is obtained from a protected computer, with no requirement of harm. Another requires that the access furthered an intended fraud and that the defendant obtained something of value. Another is built around damage, and within that group the statute distinguishes intentional damage caused by a knowing transmission from damage caused recklessly or without intent following intentional access.

Separate provisions address computers used by or for a federal agency, information the government protects for national security reasons, trafficking in passwords and similar access credentials, and extortionate demands connected to threats against a computer or to information taken from one.

Some of these theories also require damage or loss as the statute defines those terms, and certain of them require a threshold to be met. Those definitions and thresholds are elements rather than sentencing factors, and because the section has been amended over time, they should be confirmed against the current statutory text with counsel.

Frequently Asked Questions

What does exceeding authorized access mean?

It refers to using permitted access to obtain information the person was not entitled to reach. Under the narrower reading courts have adopted, it does not cover using permitted access for an improper purpose. That distinction turns the element into a documentary question about permissions and entitlements at the relevant time, which is usually answered by access control records rather than by testimony about motive.

Does the government have to prove damage?

Only under the provisions that require it. Theories built on obtaining information are complete without any harm to the system, while the transmission provisions are constructed around damage, and some theories require a loss threshold set in the statute. Determining which provision is charged therefore controls whether harm is something the government must prove or merely something it will describe as background.

Is intent an element?

In most provisions, yes, but the required mental state varies. Several require that the access itself was intentional. Some require that the defendant acted knowingly in transmitting a program, code, or command. One requires an intent to defraud accompanied by obtaining something of value. A defendant may satisfy the mental state of one provision while falling outside another, which is why the analysis is provision by provision rather than general.

What is a protected computer in practice?

Effectively any computer used in or affecting interstate or foreign commerce or communication, along with computers used by financial institutions and by the federal government. In everyday terms that includes almost anything connected to the internet, including mobile devices and cloud hosted systems. Defendants rarely prevail on this element, and defense effort is better directed at authorization, at attribution, and at the consequence elements.

Can a person be liable for someone else conduct?

Yes, through the ordinary federal doctrines. Aiding and abetting reaches a person who knowingly assists the offense, and the statute itself addresses attempt and conspiracy. Supplying credentials, writing a tool with knowledge of its intended use, or directing a subordinate to obtain material can create exposure without the person ever touching the system. Those theories still require proof of the underlying elements.

Where are these elements decided for northern Virginia cases?

In the United States District Court for the Eastern District of Virginia, with appeals to the United States Court of Appeals for the Fourth Circuit. Because a great deal of network infrastructure and a large number of federal agencies and contractors sit within the district, computer cases with only a limited local connection are frequently brought there, and the law of that circuit governs how the elements are framed for a jury.

How Mr. Sris and the Firm’s Of Counsel Attorneys Handle Element-Level Analysis in Computer Cases

Element analysis in a computer case starts by pinning down which provision is charged. The access requirement is common to all of them, but the consequence each one demands is different, and that difference decides which records matter.

Mr. Sris, Owner and Founder of Law Offices Of SRIS, P.C., is a former prosecutor and founded the firm in 1997. He is admitted in Virginia, Maryland, the District of Columbia, New Jersey, and New York. His background at George Mason University in accounting and information systems is applied to complex financial and technology-related cases, which is the category these matters fall into. Mr. Sris and the firm’s Of Counsel attorneys, who contract directly with the firm, work on federal criminal matters together.

The firm represents individuals and companies in Computer Fraud and Abuse Act matters in federal court, including investigations that have not yet produced a charge. To discuss the elements at issue under 18 U.S.C. § 1030, call (888) 437-7747 to request a consultation.

Disclaimers

This page describes the elements of the offenses defined by the Computer Fraud and Abuse Act at 18 U.S.C. § 1030 in general terms for people trying to understand a federal process. It is not legal advice, and reading it does not create an attorney-client relationship with Law Offices Of SRIS, P.C. Federal statutes and the decisions interpreting them change over time, so confirm anything stated here against the current statutory text with counsel before acting on it.

Every federal matter turns on facts that belong to that matter alone. Case results depend on a variety of factors unique to each case. Results may vary.

Attorney responsible for this advertising: Mr. Sris. Law Offices Of SRIS, P.C. Call (888) 437-7747 to request a consultation; the firm’s intake line is staffed 24/7.

Attorney advertising. Prior results do not guarantee a similar outcome.

These are the elements the government must prove. Our page on computer fraud and abuse act charges covers the offence as a whole.