Computer Fraud and Abuse Act Penalties and Sentencing

There is no single penalty under the Computer Fraud and Abuse Act. The statute at 18 U.S.C. § 1030 grades its offenses in tiers, and which tier applies depends on what was accessed, what was done with it, whether damage or loss resulted, and whether the person has a prior conviction under the same section. The maximum term for each tier is fixed in the statutory text, and that text has been amended more than once, so confirm the applicable ceiling against the current statute with counsel rather than relying on a figure found online.

The ceiling is rarely the number that matters anyway. For a defendant who is convicted or who pleads, the sentence actually imposed is calculated through the federal sentencing guidelines and then set by a judge who considers the statutory sentencing factors. Understanding that calculation is how a defendant understands the realistic range. To discuss sentencing exposure in a Computer Fraud and Abuse Act matter, call (888) 437-7747 to request a consultation.

On this page

How the Statutory Tier Is Selected

The grading scheme distinguishes conduct that simply obtains information from conduct that furthers a fraud, damages a system, or involves national security information. It also distinguishes intentional damage from reckless damage and from damage caused without intent, and it treats a repeat offense under the section more seriously than a first one.

Several of the more serious tiers depend on facts that must be established rather than assumed, such as whether the access was in furtherance of a criminal or tortious act, whether the value obtained crossed a threshold set in the statute, and whether damage affected systems the statute singles out for protection. Those thresholds and categories are technical, and moving a case from one tier to another is often a more productive defense objective than contesting the access itself.

How the Guideline Range Is Built

The guidelines start from a base offense level and adjust it. In computer cases the adjustments that move the range most are loss, the number of victims, whether the offense involved sophisticated means, whether personal information was obtained, whether the intrusion damaged systems used by government or critical infrastructure, and the role the defendant played.

Loss is contested more than any other input. The government commonly builds a loss figure from the cost of the incident response, forensic investigation, restoration, and lost revenue during an outage. Whether all of those categories belong in the figure, whether the work would have been done anyway as routine security improvement, and whether the costs are documented rather than estimated are all litigable, and the answer moves the range in steps rather than smoothly.

Adjustments run downward as well. Acceptance of responsibility applies where a defendant admits the conduct promptly. A minor role reduction may apply where the defendant acted on direction. Where cooperation is provided, prosecutors may seek a departure, though whether to cooperate is a decision with consequences that reach well beyond sentencing.

What Follows the Term of Imprisonment

Restitution in computer cases is often the largest financial consequence, and it is calculated separately from any fine. Forfeiture of devices and equipment used in the offense is routine. Supervised release commonly carries computer and internet conditions, including monitoring software, restrictions on devices in the household, and limits on employment involving system administration, and those conditions can affect a career far longer than the custodial term does.

Collateral consequences deserve attention early. A conviction under the section can end a security clearance, which in the Washington region frequently means the end of a professional path. Professional licences, immigration status for non citizens, and eligibility for federal employment or contracting are each affected. Because these consequences follow the conviction rather than the sentence, they belong in the analysis of any plea offer from the beginning.

Frequently Asked Questions

Is a first offense under the statute a misdemeanor?

Sometimes, depending entirely on which theory the government charges. The statute grades its offenses in tiers, and the lowest tier for simply obtaining information without an aggravating factor is treated far less seriously than intentional damage or access in furtherance of fraud. Because the tiers and their maximum terms are set in the statutory text and have been amended, the applicable grade in a particular case should be confirmed against the current statute with counsel.

What counts as loss for sentencing?

More than the value of anything taken. The government typically includes the cost of responding to the incident, conducting a forensic investigation, restoring data and systems, and revenue lost during an interruption of service. Each category is contestable. Security upgrades that the organization needed anyway, work performed by salaried staff, and estimates unsupported by records are all common points of dispute, and because the guideline table moves in steps, a successful challenge can change the range meaningfully.

Does restitution apply even without a prison sentence?

Yes. Restitution is a separate component of a federal judgment and is ordered based on the loss to identifiable victims, independent of whether the sentence includes custody. In computer cases it frequently exceeds any fine and can follow a defendant for years. Because restitution figures are built from the same records as the guideline loss calculation, the two are usually litigated together rather than separately.

Will a conviction affect a security clearance?

Almost certainly. A conviction involving unauthorized computer access goes directly to the judgment and trustworthiness criteria that clearance adjudicators apply, and in the Washington region the loss of a clearance often means the loss of the underlying career rather than just one position. This consequence should be weighed alongside the custodial exposure when any resolution is being considered, because it does not depend on the length of the sentence.

Do the computer conditions on supervised release ever get modified?

They can be. Conditions must be reasonably related to the offense and no broader than necessary, and courts have narrowed conditions that amounted to a near total ban on internet use in ordinary modern life. Modification is sought by motion, usually with evidence of compliance and of the practical effect on employment. Raising proportionality at the original sentencing, however, is far more effective than seeking modification later.

Does pleading early reduce exposure?

It can, through acceptance of responsibility and through what prosecutors are willing to charge, but the calculation is not simple. An early plea forecloses motions that might have narrowed or ended the case, particularly on authorization, which is the element most likely to be contested successfully in these matters. The sequence question, meaning whether to litigate first and resolve later, is one of the most consequential decisions in a computer case.

How Mr. Sris and the Firm’s Of Counsel Attorneys Handle Sentencing Exposure in Computer Cases

Sentencing work in a computer case is largely an argument about loss and about which statutory tier applies, and both are answered with records rather than adjectives. Incident response invoices, forensic reports, and the configuration of the affected systems are the material that moves a range.

Mr. Sris, Owner and Founder of Law Offices Of SRIS, P.C., is a former prosecutor and founded the firm in 1997. He is admitted in Virginia, Maryland, the District of Columbia, New Jersey, and New York. His background at George Mason University in accounting and information systems is applied to complex financial and technology-related cases, which is the category these matters fall into. Mr. Sris and the firm’s Of Counsel attorneys, who contract directly with the firm, work on federal criminal matters together.

The firm represents individuals and companies facing Computer Fraud and Abuse Act exposure, from the investigative stage through sentencing and supervised release conditions. To discuss sentencing exposure under 18 U.S.C. § 1030, call (888) 437-7747 to request a consultation.

Disclaimers

This page describes penalty and sentencing exposure under the Computer Fraud and Abuse Act at 18 U.S.C. § 1030 in general terms for people trying to understand a federal process. It is not legal advice, and reading it does not create an attorney-client relationship with Law Offices Of SRIS, P.C. Federal statutes and the decisions interpreting them change over time, so confirm anything stated here against the current statutory text with counsel before acting on it.

Every federal matter turns on facts that belong to that matter alone. Case results depend on a variety of factors unique to each case. Results may vary.

Attorney responsible for this advertising: Mr. Sris. Law Offices Of SRIS, P.C. Call (888) 437-7747 to request a consultation; the firm’s intake line is staffed 24/7.

Attorney advertising. Prior results do not guarantee a similar outcome.

These penalties attach to one offence. Our page on computer fraud and abuse act charges covers the offence as a whole.