.

Cybercrime: An Overview of the
Federal Computer Fraud and Abuse Statute
and Related Federal Criminal Laws

Charles Doyle
Senior Specialist in American Public Law
March 21, 2012
Congressional Research Service
7-5700
www.crs.gov
97-1025
CRS Report for Congress
Pr
epared for Members and Committees of Congress
c11173008


.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Summary
The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030, outlaws conduct that victimizes
computer systems. It is a cyber security law. It protects federal computers, bank computers, and
computers connected to the Internet. It shields them from trespassing, threats, damage, espionage,
and from being corruptly used as instruments of fraud. It is not a comprehensive provision, but
instead it fills cracks and gaps in the protection afforded by other federal criminal laws. This is a
brief sketch of CFAA and some of its federal statutory companions, including the amendments
found in the Identity Theft Enforcement and Restitution Act, P.L. 110-326, 122 Stat. 3560 (2008).
In their present form, the seven paragraphs of subsection 1030(a) outlaw
• computer trespassing (e.g., hacking) in a government computer, 18 U.S.C.
1030(a)(3);
• computer trespassing (e.g., hacking) resulting in exposure to certain
governmental, credit, financial, or computer-housed information, 18 U.S.C.
1030(a)(2);
• damaging a government computer, a bank computer, or a computer used in, or
affecting, interstate or foreign commerce (e.g., a worm, computer virus, Trojan
horse, time bomb, a denial of service attack, and other forms of cyber attack,
cyber crime, or cyber terrorism), 18 U.S.C. 1030(a)(5);
• committing fraud an integral part of which involves unauthorized access to a
government computer, a bank computer, or a computer used in, or affecting,
interstate or foreign commerce, 18 U.S.C. 1030(a)(4);
• threatening to damage a government computer, a bank computer, or a computer
used in, or affecting, interstate or foreign commerce, 18 U.S.C. 1030(a)(7);
• trafficking in passwords for a government computer, or when the trafficking
affects interstate or foreign commerce, 18 U.S.C. 1030(a)(6); and
• accessing a computer to commit espionage, 18 U.S.C. 1030(a)(1).
Subsection 1030(b) makes it a crime to attempt or conspire to commit any of these offenses.
Subsection 1030(c) catalogs the penalties for committing them, penalties that range from
imprisonment for not more than a year for simple cyberspace trespassing to a maximum of life
imprisonment when death results from intentional computer damage. Subsection 1030(d)
preserves the investigative authority of the Secret Service. Subsection 1030(e) supplies common
definitions. Subsection 1030(f) disclaims any application to otherwise permissible law
enforcement activities. Subsection 1030(g) creates a civil cause of action for victims of these
crimes. Subsections 1030(i) and (j) authorize forfeiture of tainted property.
This report is available in abbreviated form—without the footnotes, citations, quotations, or
appendixes found in this report—under the title CRS Report RS20830, Cybercrime: A Sketch of
18 U.S.C. 1030 and Related Federal Criminal Laws
, by Charles Doyle.

Congressional Research Service

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Contents
Introduction...................................................................................................................................... 1
Trespassing in Government Cyberspace (18 U.S.C. 1030(a)(3)) .................................................... 2
Intent.......................................................................................................................................... 3
Unauthorized Access ................................................................................................................. 3
Affects the Use .......................................................................................................................... 5
Jurisdiction ................................................................................................................................ 5
Extraterritorial Jurisdiction ................................................................................................. 6
Penalties..................................................................................................................................... 7
Juveniles.............................................................................................................................. 8
Overview ............................................................................................................................. 8
Other Crimes ............................................................................................................................. 9
Attempt................................................................................................................................ 9
Conspiracy......................................................................................................................... 10
Accomplices as Principals................................................................................................. 11
Limited Application and State law .................................................................................... 12
Obtaining Information by Unauthorized Computer Access (18 U.S.C. 1030(a)(2)) ..................... 14
Intent........................................................................................................................................ 15
Unauthorized Access ............................................................................................................... 15
Obtaining Information and Jurisdiction................................................................................... 16
Consequences .......................................................................................................................... 18
Penalties ............................................................................................................................ 18
Sentencing Guidelines....................................................................................................... 19
Forfeiture........................................................................................................................... 21
Restitution ......................................................................................................................... 21
Civil Cause of Action ........................................................................................................ 22
Attempt, Conspiracy, and Complicity ............................................................................... 23
Other Crimes ........................................................................................................................... 24
Interstate or Foreign Transportation of Stolen Property.................................................... 25
Theft of Federal Government Information........................................................................ 26
Economic Espionage......................................................................................................... 27
Copyright infringement ..................................................................................................... 28
Money Laundering ............................................................................................................ 29
Causing Computer Damage (18 U.S.C. 1030(a)(5))...................................................................... 30
Intent........................................................................................................................................ 30
Damage.................................................................................................................................... 31
Without Authorization ............................................................................................................. 32
Jurisdiction .............................................................................................................................. 32
Consequences .......................................................................................................................... 34
Penalties ............................................................................................................................ 34
Juveniles............................................................................................................................ 38
Sentencing Guidelines....................................................................................................... 38
Forfeiture and Restitution.................................................................................................. 39
Cause of Action ................................................................................................................. 39
Crimes of Terrorism .......................................................................................................... 41
Attempt, Conspiracy, and Complicity ............................................................................... 42
Other Crimes ........................................................................................................................... 42
Congressional Research Service

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Damage or Destruction of Federal Property...................................................................... 42
Damage or Destruction of Financial Institution Property ................................................. 44
Damage or Destruction to Property in Interstate Commerce ............................................ 44
RICO ................................................................................................................................. 48
Money Laundering ............................................................................................................ 48
Computer Fraud (18 U.S.C. 1030(a)(4))........................................................................................ 49
Jurisdiction .............................................................................................................................. 49
Unauthorized or Excessive Access.......................................................................................... 50
Fraud and Intent....................................................................................................................... 51
Consequences .......................................................................................................................... 52
Other Crimes ........................................................................................................................... 52
Interstate and Foreign Commerce ..................................................................................... 53
Defrauding the Federal Government................................................................................. 58
Bank Fraud ........................................................................................................................ 59
General Crimes.................................................................................................................. 60
Extortionate Threats (18 U.S.C. 1030(a)(7)) ................................................................................. 64
Jurisdiction .............................................................................................................................. 64
Threat of “Damage” ................................................................................................................ 65
Intent........................................................................................................................................ 66
Consequences .......................................................................................................................... 67
Penalties and Civil Liability.............................................................................................. 67
Other Consequences.......................................................................................................... 67
Attempt, Conspiracy, and Complicity ............................................................................... 67
Other Crimes ........................................................................................................................... 68
Hobbs Act.......................................................................................................................... 68
Threat Statutes................................................................................................................... 69
RICO, Money Laundering, and the Travel Act ................................................................. 70
Trafficking in Computer Access (18 U.S.C. 1030(a)(6))............................................................... 71
Jurisdiction .............................................................................................................................. 71
Intent........................................................................................................................................ 72
Consequences .......................................................................................................................... 72
Penalties ............................................................................................................................ 72
Other Consequences.......................................................................................................... 72
Other Crimes ........................................................................................................................... 73
Computer Espionage (18 U.S.C. 1030(a)(1)) ................................................................................ 73
Jurisdiction .............................................................................................................................. 74
Intent........................................................................................................................................ 75
Consequences .......................................................................................................................... 75
Penalties and Sentencing Guidelines................................................................................. 75
Federal Crime of Terrorism............................................................................................... 75
Other Consequences.......................................................................................................... 76
Attempt, Conspiracy, and Complicity ............................................................................... 76
Other Crimes ........................................................................................................................... 76
Espionage Offenses ........................................................................................................... 77
Economic Espionage......................................................................................................... 80
18 U.S.C. 1030. Computer Fraud and Abuse (text) ....................................................................... 81
18 U.S.C. 1956. Money Laundering (text) .................................................................................... 85
18 U.S.C. 1961(1). RICO Predicate Offenses (text)...................................................................... 90
Congressional Research Service

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

18 U.S.C. 2332b(g)(5)(B). Federal Crimes of Terrorism (text)..................................................... 91

Contacts
Author Contact Information........................................................................................................... 91

Congressional Research Service

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Introduction
The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030,1 protects computers in which there
is a federal interest—federal computers, bank computers, and computers used in or affecting
interstate and foreign commerce. It shields them from trespassing, threats, damage, espionage,
and from being corruptly used as instruments of fraud. It is not a comprehensive provision;
instead it fills cracks and gaps in the protection afforded by other state and federal criminal laws.
It is a work that over the last three decades, Congress has kneaded, reworked, recast, amended,
and supplemented to bolster the uncertain coverage of the more general federal trespassing,
threat, malicious mischief, fraud, and espionage statutes.2 This is a brief description of Section
1030 and its federal statutory companions. There are other laws that address the subject of crime
and computers. CFAA deals with computers as victims; other laws deal with computers as arenas
for crime or as repositories of the evidence of crime or from some other perspective. These other
laws—laws relating to identity theft generally, obscenity, pornography, gambling, among
others—are beyond the scope of this report.3
In their present form, the seven paragraphs of subsection 1030(a) outlaw

1 The full text of 18 U.S.C. 1030 can be found at the end of this report. Earlier versions of this report appeared under
the title, Computer Fraud and Abuse: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws.
2 Congressional inquiry began no later than 1976, S. Comm. on Government Operations, Problems Associated with
Computer Technology in Federal Programs and Private Industry – Computer Abuses
, 94th Cong., 2d Sess. (1976)
(Comm.Print). Hearings were held in successive Congresses thereafter until passage of the original version of §1030 as
part of the Comprehensive Crime Control Act of 1984, P.L. 98-473, 98 Stat. 2190; see e.g., Federal Computer Systems
Protection Act: Hearings Before the Subcomm. on Criminal Laws and Procedures of the Senate Comm. on the
Judiciary
, 95th Cong., 2d Sess.(1978); S. 240, the Computer Systems Protection Act of 1979: Hearings Before the
Subcomm. on Criminal Justice of the Senate Comm. on the Judiciary
, 96th Cong., 2d Sess.(1980); Federal Computer
System Protection Act, H.R. 3970: Hearings Before the House Comm. on the Judiciary
, 97th Cong., 2d Sess.(1982);
Computer Crime: Hearings Before the House Comm. on the Judiciary, 98th Cong., 1st Sess. (1983).
Refurbishing of the original 1984 legislation occurred in 1986, 1988, 1989, 1990, 1994, and 1996: P.L. 99-474, 100
Stat. 1213; P.L. 100-690, 102 Stat. 4404; P.L. 101-73, 103 Stat. 502; P.L. 101-647, 104 Stat. 4831; P.L. 103-322, 108
Stat. 2097; P.L. 104-294, 110 Stat. 3491. Most recently, both the USA PATRIOT Act, P.L. 107-56, 115 Stat. 272
(2001), the Department of Homeland Security Act, P.L. 107-296, 116 Stat. 2135 (2002), and the Identity Theft
Enforcement and Restitution Act of 2008, Title II of P.L. 110-326, 122 Stat. 3560 (2008) amended provisions of the
section.
For a chronological history of the statute up to but not including the 1996 amendments, see Adams, Controlling
Cyberspace: Applying the Computer Fraud and Abuse Act to the Internet
, 12 SANTA CLARA COMPUTER & HIGH
TECHNOLOGY LAW JOURNAL 403 (1996). For a general description of the validity and application of this act, see ;
Buchman, Validity, Construction, and Application of Computer Fraud and Abuse Act, 174 ALR Fed. 101; Berkowitz,
Computer Security and Privacy: The Third Wave of Property Law, 33 COLORADO LAWYER 57 (2004); Prosecuting
Intellectual Property Crimes
, COMPUTER CRIME AND INTELLECTUAL PROPERTY SECTION, CRIMINAL DIVISION, UNITED
STATES DEPARTMENT OF JUSTICE [(2006)](DoJ Computer Crime), available at
http://www.cybercrime.gov/ipmanual/ipma2006.pdf; and Computer Fraud and Abuse Act, Prosecuting Computer
Crime
, COMPUTER CRIME AND INTELLECTUAL PROPERTY SECTION, CRIMINAL DIVISION, UNITED STATES DEPARTMENT OF
JUSTICE [(2007)](DoJ Cyber Crime), available at http://www.cybercrime.gov/ccmanual/ccmanual.pdf.
3 For a discussion of these and similar matters see, Twenty-Sixth Survey of White Collar Crime: Computer Crimes, 48
AMERICAN CRIMINAL LAW REVIEW 375 (2011); CRS Report RL31919, Federal Laws Related to Identity Theft; CRS
Report 95-804, Obscenity and Indecency: Constitutional Principles and Federal Statutes; CRS Report 95-406, Child
Pornography: Constitutional Principles and Federal Statutes
; CRS Report 97-619, Internet Gambling: An Overview of
Federal Criminal Law
; Kerr, Applying The Fourth Amendment to the Internet: A General Approach, 62 STANFORD
LAW REVIEW 1005 (2010); Mehra, Law and Cybercrime in the United States Today, 58 AMERICAN JOURNAL OF
COMPARATIVE LAW 659 (2010); DoJ Cyber Crime.
Congressional Research Service
1

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

• computer trespassing in a government computer, 18 U.S.C. 1030(a)(3);
• computer trespassing resulting in exposure to certain governmental, credit,
financial, or computer-housed information, 18 U.S.C. 1030(a)(2);
• damaging a government computer, a bank computer, or a computer used in, or
affecting, interstate or foreign commerce, 18 U.S.C. 1030(a)(5);
• committing fraud an integral part of which involves unauthorized access to a
government computer, a bank computer, or a computer used in, or affecting,
interstate or foreign commerce, 18 U.S.C. 1030(a)(4);
• threatening to damage a government computer, a bank computer, or a computer
used in, or affecting, interstate or foreign commerce, 18 U.S.C. 1030(a)(7);
• trafficking in passwords for a government computer, or when the trafficking
affects interstate or foreign commerce, 18 U.S.C. 1030(a)(6); and
• accessing a computer to commit espionage, 18 U.S.C. 1030(a)(1).
Subsection 1030(b) makes it a crime to attempt or conspire to commit any of these offenses.
Subsection 1030(c) catalogs the penalties for committing them, penalties that range from
imprisonment for not more than a year for simple cyberspace trespassing to imprisonment for not
more than 20 years for a second espionage-related conviction and to life imprisonment for death-
result offenses. Subsection 1030(d) preserves the investigative authority of the Secret Service.
Subsection 1030(e) supplies common definitions. Subsection 1030(f) disclaims any application to
otherwise permissible law enforcement activities. Subsection 1030(g) creates a civil cause of
action for victims of these crimes. Subsection 1030(h), which has since expired, called for annual
reports through 1999 from the Attorney General and Secretary of the Treasury on investigations
under the damage paragraph (18 U.S.C. 1030(a)(5)). And subsections 1030(i) and (j) authorize
the confiscation of property generated by, or used to facilitate the commission of, one of the
offenses under subsection 1030(a) or (b).
Trespassing in Government Cyberspace
(18 U.S.C. 1030(a)(3))

(a) Whoever ... (3) intentionally, without authorization to access any nonpublic computer4 of
a department or agency of the United States,5 accesses such a computer of that department
or agency that is exclusively for the use of the Government of the United States or, in the
case of a computer not exclusively for such use, is used by or for the Government of the
United States and such conduct affects that use by or for the Government of the United States
... shall be punished as provided in subsection (c) of this section.
(b) Whoever attempts to commit an offense under subsection (a) of this section shall be
punished as provided in subsection (c) of this section.


4 “(e) As used in this section ... (1) the term ‘computer’ means an electronic, magnetic, optical, electrochemical, or
other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data
storage facility or communications facility directly related to or operating in conjunction with such device, but such
term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device,”
18 U.S.C. 1030(e)(1).
5 “(e) As used in this section ... (7) the term ‘department of the United States’ means the legislative or judicial branch of
the Government or one of the executive departments enumerated in Section 101 of title 5,” 18 U.S.C. 1030(e)(7).
Congressional Research Service
2

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Paragraph 1030(a)(3) condemns unauthorized intrusion (“hacking”) into federal government
computers whether they are used exclusively by the government or the government shares access
with others. With the help of subsection 1030(b) it also outlaws attempted intrusions and
conspiracies to intrude. In the case of shared computers, a crime only occurs if the unauthorized
access “affects ... use by or for” the government or would affect such use if an attempted effort
had succeeded.
Broken down into its elements, paragraph (a)(3) makes it unlawful for anyone to
• without authorization
• intentionally
• either
- access a government computer maintained exclusively for the use of the federal
government,
- access a government computer used, at least in part, by or for the federal government
and the access affects use by or for the federal government,
- attempts to do so (18 U.S.C. 1030(b)) or
- conspires to do so (18 U.S.C. 1030(c)).
This pure trespassing proscription dates from 1986 and its legislative history leaves little doubt
that nothing more than unauthorized entry is required:
“[S]ection 2(b) will clarify the present 18 U.S.C. 1030(a)(3), making clear that it applies to
acts of simple trespass against computers belonging to, or being used by or for, the Federal
Government. The Department of Justice and others have expressed concerns about whether
the present subsection covers acts of mere trespass, i.e., unauthorized access, or whether it
requires a further showing that the information perused was ‘used, modified, destroyed, or
disclosed.’ To alleviate those concerns, the Committee wants to make clear that the new
subsection will be a simple trespass offense, applicable to persons without authorized access
to Federal computers,” S.Rept. 99-432 at 7 (1986); see also, H.Rept. 99-612 at 11 (1986).
Intent
The paragraph only bans “intentional” trespassing. The reports are instructive here, for they make
it apparent that the element cannot be satisfied by a mere inadvertent trespass and nothing more.
It is intended, however, to cover anyone who purposefully accomplishes the proscribed
unauthorized entry into a government computer, and, at least in the view of the House report,
anyone “whose initial access was inadvertent but who then deliberatively maintains access after a
non-intentional initial contact,” H.Rept. 99-612 at 9-10 (1986); see also, S.Rept. 99-432 at 5-6
(1986).
Unauthorized Access
While the question of what constitutes “access without authorization” might seem fairly
straightforward, Congress was willing to accept a certain degree of trespassing by government
employees in order to protect whistleblowers:
The Committee wishes to be very precise about who may be prosecuted under the new
subsection (a)(3). The Committee was concerned that a Federal computer crime statute not
Congressional Research Service
3

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

be so broad as to create a risk that government employees and others who are authorized to
use a Federal Government computer would not face prosecution for acts of computer access
and use that, while technically wrong, should not rise to the level of criminal conduct. At the
same time, the Committee was required to balance its concern for Federal employees and
other authorized users against the legitimate need to protect Government computers against
abuse by “outsiders.” The Committee struck that balance in the following manner.
In the first place, the Committee has declined to criminalize acts in which the offending
employee merely ‘exceeds authorized access’ to computers in his own department
(“department”‘ is defined in Section 2(g) of S. 2281 [now 18 U.S.C. 1030(e)(7)]). It is not
difficult to envision an employee or other individual who, while authorized to use a
particular computer in one department, briefly exceeds his authorized access and peruses
data belonging to the department that he is not supposed to look at. This is especially true
where the department in question lacks a clear method of delineating which individuals are
authorized to access certain of its data. The Committee believes that administrative sanctions
are more appropriate than criminal punishment in such a case. The Committee wishes to
avoid the danger that every time an employee exceeds his authorized access to his
department’s computers – no matter how slightly – he could be prosecuted under this
subsection. That danger will be prevented by not including “exceeds authorized access” as
part of this subsection’s offense.
In the second place, the Committee has distinguished between acts of unauthorized access
that occur within a department and those that involve trespasses into computers belonging to
another department. The former are not covered by subsection (a)(3); the latter are. Again, it
is not difficult to envision an individual who, while authorized to use certain computers in
one department, is not authorized to use them all. The danger existed that S. 2281, as
originally introduced, might cover every employee who happens to sit down, within his
department, at a computer terminal which he is not officially authorized to use. These acts
can also be best handled by administrative sanctions, rather than by criminal punishment. To
that end, the Committee has constructed its amended version of (a)(3) to prevent prosecution
of those who, while authorized to use some computers in their department, use others for
which they lack the proper authorization. By precluding liability in purely ‘insider’ cases
such as these, the Committee also seeks to alleviate concerns by Senators Mathias and Leahy
that the existing statute cases a wide net over “whistleblowers”....
The Committee has thus limited 18 U.S.C. 1030(a)(3) to cases where the offender is
completely outside the Government, and has no authority to access a computer of any agency
or department of the United States, or where the offender’s act of trespass is
interdepartmental in nature. The Committee does not intend to preclude prosecution under
this subsection if, for example, a Labor Department employee authorized to use Labor’s
computers accesses without authorization an FBI computer. An employee who uses his
department’s computer and, without authorization, forages into data belonging to another
department is engaged in conduct directly analogous to an ‘outsider’ tampering with
Government computers....
The Committee acknowledges that in rare circumstances this may leave serious cases of
intradepartmental trespass free from criminal prosecution under (a)(3). However, the
Committee notes that such serious acts may be subject to other criminal penalties if, for
example, they violate trade secrets laws or 18 U.S.C. 1030(a)(1), (a)(4), (a)(5), or (a)(6), as
proposed in this legislation. S.Rept. 99-432 at 7-8 (1986); see also, H.Rept. 99-612 at 11
(1986).
Congressional Research Service
4

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Affects the Use
Trespassing upon governmental computer space on computers that are not exclusively for
governmental use is prohibited only when it affects use by the government or use for
governmental purposes. The committee reports provide a useful explanation of the distinctive,
“affects-the-use” element of the trespassing ban:
[T]respassing in a computer used only part-time by the Federal Government need not be
shown to have affected the operation of the government as a whole. The Department of
Justice has expressed concerns that the present subsection’s language could be construed to
require a showing that the offender’s conduct would be an exceedingly difficult task for
Federal prosecutors. Accordingly, Section 2(b) will make clear that the offender’s conduct
need only affect the use of the Government’s operation of the computer in question [or the
operation of the computer in question on behalf of the Government]. S.Rept. 99-432 at 6-7
(1986); see also, H.Rept. 99-612 at 11 (1986); S.Rept. 104-357 at 9 (1996).
Jurisdiction
The reports offer little insight into the meaning of the third element—what computers are
protected from trespassing. There may be two reasons. Paragraph 1030(a)(3) protects only
government computers and therefore explanations of the sweep of its coverage in the area of
interstate commerce or of financial institutions are unnecessary. Besides, at least for purposes of
these trespassing offenses of paragraph 1030(a)(3), the statute itself addresses several of the
potentially more nettlesome questions.
First, the construction of the statute itself strongly suggests that it reaches only computers owned
or leased by the federal government: “whoever ... without authorization to access any nonpublic
computer of a department or agency of the United States, accesses such a computer of that
department or agency
....”
Second, the language of the statute indicates that “nonpublic” computers may nevertheless
include government computers that the government allows to be used by nongovernmental
purposes: “in the case of a [government] computer not exclusively for the use of the Government
of the United States
....”
Third, the statute covers government computers that are available to nongovernment users:
“accesses such a computer ... that ... in the case of a [government] computer not exclusively for
the use of the Government of the United States, is used by or for the Government of the United
States....” The use of the term “nonpublic,” however, makes it clear that this shared access may
not be so broad as to include the general public.
Finally, the section supplies a definition of “department of the United States”: “[a]s used in this
section ... the term ‘department of the United States’ means the legislative or judicial branch of
the Government or one of the executive departments enumerated in Section 101 of title 5”;6 and

6 18 U.S.C. 1030(e)(7). “The Executive departments are: The Department of State. The Department of the Treasury.
The Department of Defense. The Department of Justice. The Department of the Interior. The Department of
Agriculture. The Department of Commerce. The Department of Labor. The Department of Health and Human Services.
The Department of Housing and Urban Development. The Department of Transportation. The Department of Energy.
The Department of Education. The Department of Veterans Affairs. The Department of Homeland Security.” 5 U.S.C.
(continued...)
Congressional Research Service
5

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

the title supplies a definition of “agency of the United States”: “[a]s used in this title ... [t]he term
‘agency’ includes any department, independent establishment, commission, administration,
authority, board or bureau of the United States or any corporation in which the United States has a
proprietary interest, unless the context shows that such term was intended to be used in a more
limited sense.”7
Extraterritorial Jurisdiction
There is one jurisdictional aspect of paragraph 1030(a)(3) that is unclear. Under what
circumstances, if any, does the paragraph reach hacking initiated or occurring overseas? As a
general rule, federal laws are presumed to apply within the United States and not overseas.8 In
some instances, Congress explicitly negates the presumption. The treason statute, for example,
outlaws the offense whether committed “within the United States or elsewhere.”9
In other instances, when the criminal statute is silent, the courts will conclude that Congress must
have intended the statute to apply to overseas misconduct because of the nature of the offense and
the circumstances under which it was committed. For example, the Supreme Court concluded that
Congress must have intended the federal statute that prohibited fraud against the federal
government to apply to fraud against the United States committed abroad, particularly when
the offenders were Americans.10 The Court later decided that a federal statute that outlawed
conspiracy to violate federal law applied to an overseas conspiracy to smuggle liquor into this
country.11
In the cybercrime context, at least one court determined that paragraph 1030(a)(4), which
prohibits unauthorized computer access to defraud, applied to a hacker in Russia who gained
unauthorized access to “protected computers” in this country.12 The court’s conclusion was
influenced by an amendment in which Congress had added computers used in “foreign commerce
or communications” to the definition of “protected computers” and by the legislative history of
why it did so.13 While the case was pending, Congress further amended the definition of

(...continued)
101.
7 18 U.S.C. 6.
8 Morrison v. National Australia Bank, Ltd., 130 S.Ct. 2869, 2877 (2010)(“It is a longstanding principle of American
law that legislation of Congress, unless a contrary intent appears, is meant to apply only within the territorial
jurisdiction of the United States”). See generally, CRS Report 94-166, Extraterritorial Application of American
Criminal Law.

9 18 U.S.C. 2381.
10 United States v. Bowman, 260 U.S. 94, 98 (1922)(“But the same rule of [territorial] interpretation should not be
applied to criminal statutes which ... are enacted because of the right of the Government to defend itself against
obstruction, or fraud wherever perpetrated, especially if committed by its own citizens, officers or agents. Some such
offenses ... are such that to limit their locus to the strictly territorial jurisdiction would be greatly to curtail the scope
and usefulness of the statute and leave open a large immunity for frauds as easily committed by citizens on the high
seas and in foreign countries as at home. In such cases, Congress has not thought it necessary to make specific
provision in the law that the locus shall include the high seas and foreign countries, but allows it to be inferred from the
nature of the offense”).
11 Ford v. United States, 273 U.S. 589, 623 (1927)(“The principle that a man who outside a country willfully puts in
motion a force to take effect in it is answerable at the place where the evil is done, is recognized in the criminal
jurisprudence of all countries”).
12 United States v. Ivanov, 175 F.Supp.2d 367, 374-75 (D. Conn. 2001).
13 Id. at 374 (“The Committee specifically noted its concern that the statute as it existed prior to the 1996 amendments
(continued...)
Congressional Research Service
6

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

“protected computer” to include “a computer located outside the United States that is used in a
manner that affects interstate or foreign commerce or communication of the United States.”14
Paragraph 1030(a)(3) does not cover “protected computers;” it covers nonpublic, federal
government computers. Congress explicitly provided extraterritorial jurisdiction over the
computer-related information acquisition, fraud, damage, and extortion offenses by amending the
definition of protected computer. It provided no such explicit provision for simple trafficking
offense under paragraph 1030(a)(3).
A court might conclude that Congress meant both to grant extraterritorial application in
computer-related information acquisition, fraud, damage, and extortion cases under paragraphs
1030(a)(2), (4), (5), and (7) and to foreclose extraterritorial application in simple trespassing
cases under paragraph 1030(a)(3)—even under circumstances when the courts would have
otherwise found it appropriate in a simple trespassing case.
Penalties
The penalties for conspiracy to violate, or for violations or attempted violations of, paragraph
1030(a)(3) are imprisonment for not more than one year and/or a fine of not more than $100,000
($200,000 for organizations) for the first offense and imprisonment for not more than 10 years
and/or a fine of not more than $250,000 ($500,000 for organizations) for all subsequent
convictions.15
Offenses under other paragraphs may trigger forfeiture, restitution, racketeering, money
laundering, sentencing guidelines, and civil liability provisions elsewhere in the law. For reasons
that will become apparent when they are discussed later in this report, those provisions have little,
if any, relevance in case of simple trespassing offenses under paragraph 1030(a)(3). The forfeiture
provisions of subsections 1030(i) and (j), however, do authorize the confiscation of a cyber
trespasser’s computer and any other property that facilitated the offense.16

(...continued)
did not cover ‘computers used in foreign communications or commerce, despite the fact hackers are often foreign-
based.’ The Committee cited two specific cases in which foreign-based hackers had infiltrated computer systems in the
United States, as examples of the kind of situation the amendments were intended to address.... Congress has the power
to apply its statutes extraterritorially, and in the case of 18 U.S.C. 1030, it has clearly manifested its intention to do
so”), quoting and citing, S.Rept. 104-357, at 4-5 (1996).
14 18 U.S.C. 1030(e)(2)(B). Paragraph 814(d)(1) of the USA PATRIOT Act, P.L. 107-56, 115 Stat. 384 (2001), made
the change.
15 18 U.S.C. 1030(c), 3571. By virtue of 18 U.S.C. 3571, all felonies are subject to fines of not more than the greater of
$250,000 or twice the amount of the pecuniary gain or loss associated with the offense, unless provisions applicable to
a specific crime either call for a higher maximum fine or were enacted subsequent to 1984 when the general provisions
of §3571 became effective.
Most federal criminal statutes give the impression that offenders may be sentenced to imprisonment, to a fine or to both
imprisonment and a fine. This may be something of an illusion in most serious federal cases. Federal sentencing is
influenced by sentencing guidelines that calibrate sentencing levels beneath the maximum terms established in the
statute for a particular offense, according to the circumstances of the crime and the offender, see generally, CRS Report
R41696, How the Federal Sentencing Guidelines Work: An Overview. While a sentence in compliance with the
Guidelines is no longer mandatory, United States v. Booker, 543 U.S. 220, 226-27 (2005), federal courts must begin the
sentencing process by calculating the applicable sentencing range under the Guidelines and justify any departure from
that range, Gall v. United States, 552 U.S. 38, 49 (2007).
16 18 U.S.C. 1030(i), (j)(“(i)(1) The court, in imposing sentence on any person convicted of a violation of this section,
(continued...)
Congressional Research Service
7

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Juveniles
Historically, federal authorities did not prosecute juvenile offenders. Most federal crimes,
including computer hacking, are crimes under the laws of most states. When a juvenile violates a
federal law, he must be turned over to state juvenile authorities unless the state is unwilling or
unable to proceed against him, or unless the state has inadequate facilities for his treatment, or
unless the crime is a violent federal felony or a federal drug or firearms offense.17
Overview
Paragraph 1030(a)(3) has remained essentially unchanged since 1986,18 and there appear to have
been relatively few prosecutions under its provisions.19 The explanation may be that paragraph
1030(a)(3) tracks paragraph 1030(a)(2) so closely that the prosecution is ordinarily reserved for
the more serious cases which warrant the more serious felony sanctions available under the

(...continued)
or convicted of conspiracy to violate this section, shall order, in addition to any other sentence imposed and irrespective
of any provision of State law, that such person forfeit to the United States – (A) such person's interest in any personal
property that was used or intended to be used to commit or to facilitate the commission of such violation; and (B) any
property, real or personal, constituting or derived from, any proceeds that such person obtained, directly or indirectly,
as a result of such violation. (2) The criminal forfeiture of property under this subsection, any seizure and disposition
thereof, and any judicial proceeding in relation thereto, shall be governed by the provisions of §413 of the
Comprehensive Drug Abuse Prevention and Control Act of 1970 (21 U.S.C. 853), except subsection (d) of that section.
“(j) For purposes of subsection (i), the following shall be subject to forfeiture to the United States and no property right
shall exist in them: (1) Any personal property used or intended to be used to commit or to facilitate the commission of
any violation of this section, or a conspiracy to violate this section. (2) Any property, real or personal, which constitutes
or is derived from proceeds traceable to any violation of this section, or a conspiracy to violate this section”).
17 18 U.S.C. 5032. See generally, DoJ Cyber Crime, ch.4.D.; CRS Report RL30822, Juvenile Delinquents and Federal
Criminal Law: The Federal Juvenile Delinquency Act and Related Matters
.
18 In 1994, Congress amended the paragraph to emphasize that trespassing upon computers used part-time for the
government required a showing that government use was “adversely” affected rather than merely affected, P.L. 103-
322, 108 Stat. 2099. Concerned that it might suggest that trespassing could be beneficial, Congress repealed the 1994
amendment in 1996 when it also made changes to make it clear that a person “permitted to access publicly available
Government computers ... may still be convicted under (a)(3) for accessing without authority any nonpublic Federal
Government computer” and that a person may be convicted under paragraph (a)(3) for access that affects the use of a
computer employed on behalf of the government regardless of whether the computer is actually operated by the
government or is merely operated for the government, P.L. 104-294, 110 Stat. 3491; S.Rept. 104-357 at 9 (1996).
19 Olivenbaum, <CTRL><ALT><DELETE>: Rethinking Federal Computer Crime Legislation, 27 SETON HALL LAW
REVIEW 574, 600-1 (1997); United States v. Rice, aff’g w/o published op., 961 F.2d 211 (4th Cir. 1992), subsequent
motion for correction of sentence, 815 F.Supp. 158 (W.D.N.C. 1993).
Rice is a curious case. The unpublished opinion indicates that Rice, a longtime Internal Revenue Service (IRS)
agent, hacked into the IRS computers at the behest of a drug dealer and disclosed to the dealer the status of an IRS
investigation of the dealer; the agent also advised the dealer on means of evading forfeiture of his house. For this he
was convicted of conspiracy to launder his friend’s drug profits (18 U.S.C. 1956(a)(1)(b)(i)), conspiracy to defraud the
United States of forfeitable property (26 U.S.C. 7214), computer fraud, i.e., accessing the computer system of a
government agency without authority (18 U.S.C. 1030(a)(3)), and unauthorized disclosure of confidential information
(18 U.S.C. 1905)(sometimes known as the Trade Secrets Act). The court did not address the apparent conflict between
the conviction and the legislative history of paragraph 1030(a)(3) indicating that the paragraph does not govern cases of
an employee hacking into the computer systems of his own agency. See also, Brownlee v. Dyncorp, 349 F.3d 1343,
1346 (Fed Cir. 2003) (noting that the guilty plea to charges under §1030(a)(3) of the employee of a government
contractor resulting from the employee’s entering false data regarding hours worked into the government computer
system).
Congressional Research Service
8

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

information acquisition offense of paragraph 1030(a)(2), but not the simple trespassing offense of
paragraph 1030(a)(3).20
Other Crimes21
Attempt
An attempt to hack into a federal computer in violation of paragraph 1030(a)(3) is also punishable
as a federal crime, 18 U.S.C. 1030(b). In fact, subsection 1030(b) punishes as a federal crime any
attempt to violate any of the paragraphs of subsection 1030(a).22 The subsection dates from the
original enactment and evokes no comment in the legislative history other than the notation of its
existence.23
This is not particularly unusual. There is no general federal attempt statute,24 but Congress has
elected to penalize attempts to commit many individual federal crimes.25 A body of case law has
grown up around them that provides a common understanding of their general dimensions.26
Thus, as a general rule, in order to convict a defendant of attempt, the government must prove
beyond a reasonable doubt that, acting with the intent required to commit the underlying
offense,27 the defendant took some substantial step towards the commission of the underlying
offense28 that strongly corroborates his criminal intent.29 Mere preparation does not constitute a

20 DoJ Computer Crime, at 21 (“Section 1030(a)(3) is not charged often, and few cases interpret it. This lack is
probably because section 1030(a)(2) applies in many of the same cases in which section 1030(a)(3) could be charged.
In such cases, section 1030(a)(2) may be the preferred charge because statutory sentencing enhancements sometimes
allow section 1030(a)(2) to be charged as a felony on the first offense. A violation of section 1030(a)(3), on the other
hand, is only a misdemeanor for a first offense”).
21 Throughout this report, “other crimes” refers to closely related crimes. In any given case, a defendant charged under
one of the paragraphs of 1030(a) may also be charged under one or more of these other federal companion statutes. As
long as there is at least one element required for conviction of one but not the other, a defendant guilty of violating one
or more of the various paragraphs of §1030 may also be held liable for one or more related offenses, see e.g. United
States v. Czubinski
, 106 F.3d 1069 (1st Cir. 1997) (convictions under 18 U.S.C. 1343 (wire fraud) and 18 U.S.C.
1030(a)(4) (computer fraud) overturned for other reasons); United States v. Petersen, 98 F.3d 502 (9th Cir. 1996)
(upholding a sentence imposed for convictions under 18 U.S.C. 371 (conspiracy), 18 U.S.C. 1343 (wire fraud), and 18
U.S.C. 1030(a)(4) (computer fraud)).
22 Subsection 1030(b) states in its entirety, “Whoever conspires to commit or attempts to commit an offense under
subsection (a) of this section shall be punished as provided in subsection (c) of this section.” §207 of the Identity Theft
Enforcement and Restitution Act added the phrase in italics to the subsection 1030(b), P.L. 110-326, 122 Stat. 3563
(2008).
23 H.Rept. 98-894 at 22 (1984).
24 United States v. Neal, 78 F.3d 901, 906 (4th Cir. 1996); United States v. Adams, 305 F. 3d 30, 34 (1st Cir. 2002).
25 See e.g., 18 U.S.C. 1951 (attempt to obstruct interstate commerce by extortion or robbery); 18 U.S.C. 794 (attempt to
communicate national defense information to a foreign government). There are separate attempt offenses in over 130
sections of title 18 alone: e.g., 18 U.S.C. 32, 33, 37, 112, 115, 152.
26 See generally, CRS Report R42001, Attempt: An Overview of Federal Criminal Law.
27 United States v. Resendiz-Ponce, 549 U.S. 102, 106-107 (2007); United States v. Stallworth, 656 F.3d 721, 728 (7th
Cir. 2011); United States v. Chambers, 642 F.3d 588, 592 (7th Cir. 2011); United States v. Robertson, 606 F.3d 943,
953 (8th Cir. 2010); United States v. Rothenberg, 610 F.3d 621, 626 (11th Cir. 2010)).
28 United States v. Dominguez, 661 F.3d 1051, 1065 (11th Cir. 2011); United States v. Hunt, 656 F.3d 906, 912 (9th Cir.
2011); United States v. Wahlstrom, 588 F.3d 538, 543 (8th Cir. 2009); United States v. Mincoff, 574 F.3d 1186, 1195
(9th Cir. 2009); United States v. Gladish, 536 F.3d 646, 648 (7th Cir. 2008).
29 United States v. Smith, 665 F.3d 951, 955 (8th Cir. 2011); United States v. Irving, 665 F.3d 1184, 1197 (10th Cir.
(continued...)
Congressional Research Service
9

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

substantial step.30 The line between preparation and a substantial step towards final commission
depends largely upon the facts of a particular case,31 and the courts have offered varying
descriptions of its location.32
Conspiracy
Conspiracy to violate any federal law is a separate federal crime, 18 U.S.C. 371.33 Thus, if two or
more individuals agree to intentionally access a government computer without authorization and
one of them takes some affirmative action to effectuate their plan, each of the individuals is guilty
of conspiracy under this general conspiracy statute, regardless of whether the scheme is
ultimately successful.34 If one of the conspirators manages to “hack” into a government
computer, he and his coconspirators may all be prosecuted for violating paragraph 1030(a)(3).35
The general conspiracy statute notwithstanding, subsection 1030(b) declares that conspiracy to
commit any of the subsection 1030(a) offenses shall be punished as provided in subsection (c),
which delineates the punishment for each of the subsection 1030(a) offenses. The principles that
apply to prosecution under the general conspiracy statute apply with equal force to prosecution
under subsection 1030(b), with two exceptions. Section 371 general conspiracy prosecutions
require proof of an overt act in furtherance of the scheme, subsection 1030(b) conspiracy

(...continued)
2011); United States v. Lee, 603 F.3d 904, 914 (11th Cir. 2010); United States v. Barlow, 568 F.3d 215, 219 (5th Cir.
2009).
30 United States v. Washington, 653 F.3d 1251, 1264 (10th Cir. 201;); United States v. Berk, 652 F.3d 132, 140 (1st Cir.
2011); United States v. Huggans, 650 F.3d 1210, 1223(8th Cir. 2011); United States v. Barlow, 568 F.3d at 219; United
States v. Douglas
, 525 F.3d 225, 249 (2d Cir. 2008).
31 United States v. Spenser, 439 F.3d 905, 915 (8th Cir. 2006); United States v. Rothenberg, 610 F.3d 621, 627 (11th Cir.
2010); United States v. Irving, 665 F.3d 1184, 1195 (10th Cir. 2011).
32 United States v. Goetzke, 494 F.3d 1231, 1237 (9th Cir. 2007)(“To constitute a substantial step, a defendant’s actions
must cross the line between preparation and attempt by unequivocally demonstrating that the crime will take place
unless interrupted by independent circumstances”); United States v. Turner, 501 F.3d 59, 68 (1st Cir. 2007)(“While
‘mere preparation’ does not constitute a substantial step, a defendant does not have to get very far along the line toward
ultimate commission of the object crime in order to commit the attempt offense”); United States v. Wahlstrom, 588
F.3d. 538, 543 (8th Cir. 2009)(A substantial step .... must ... be of such a nature that a reasonable observer, viewing it in
context could conclude ... that it was undertaken in accordance with a design to commit the substantive offense”).
33 “If two or more persons conspire ... to commit any offense against the United States ... or any agency thereof in any
manner or for any purpose, and one or more of such persons do any act to effect the object of the conspiracy, each shall
be fined under this title or imprisoned not more than five years, or both.
“If, however, the offense, the commission of which is the object of the conspiracy, is a misdemeanor only, the
punishment for such conspiracy shall not exceed the maximum punishment provided for such misdemeanor,” 18 U.S.C.
371; see generally, CRS Report R41223, Federal Conspiracy Law: A Brief Overview; Twenty-Sixth Survey of White
Collar Crime: Federal Criminal Conspiracy
, 47 AMERICAN CRIMINAL LAW REVIEW 663 (2011); Developments in the
Law – Criminal Conspiracy
, 72 HARVARD LAW REVIEW 920 (1959).
34 United States v. Crippen, 627 F.3d 1056, 1066 (8th Cir. 2010); United States v. Schaffer, 586 F.3d 414, 422-23 (6th
Cir. 2009); United States v. Wittig, 575 F.3d 11085, 1104 (10th Cir. 2009).
35 Pinkerton v. United States, 328 U.S. 640, 645-48 (1946); United States v. Parkes, 497 F.3d 220, 232 (2d Cir.
2007)(Under Pinkerton v. United States, “a defendant who does not directly commit a substantive offense may
nevertheless be liable if the commission of the offense by a co-conspirator in furtherance of the conspiracy was
reasonably foreseeable to the defendant as a consequence of their criminal agreement”); United States v. Rodriguez-
Ramos
, 663 F.3d 356, 363 (8th Cir. 2011); United States v. Randall, 661 F.3d 1291, 1294 (10th Cir. 2011); United
States v. Merlino
, 592 F.3d 22, 29 (1st Cir. 2010).
Congressional Research Service
10

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

prosecutions do not.36 There is a second difference. Section 371 punishes conspiracy to commit
any federal felony with imprisonment for not more than 5 years, regardless of the maximum term
of imprisonment that attends the underlying substantive offense. Subsection 1030(b) seems to
contemplate punishing conspiracy and underlying offense alike: “Whoever conspires to commit
or attempts to commit an offense under subsection (a) of this section shall be punished a provided
in subsection (c) of this section.” Subsection 1030(c) punishes attempt and the completed offense
alike. It does not specifically mention conspiracy. The omission was likely inadvertent.37
Accomplices as Principals
Anyone who counsels, commands, aids or abets, or otherwise acts as an accessory before the fact
with respect to any federal crime is liable as a principal for the underlying substantive offense to
the same extent as the individual who actually commits the offense.38 More than mere
inadvertent assistance is required; but an accomplice who embraces the criminal objectives of
another and acts to bring about their accomplishment is criminally liable as a principal for the
completed offense.39
The fact that subsection 1030(b) outlaws attempts to violate any of the prohibitions of subsection
1030(a) raises an interesting question concerning accessories. As a general rule, an accomplice
may only be liable as a principal or accessory before the fact, for a completed crime; the aid must
be given before the crime is committed, but liability as a principal will not attach until after the
crime has been committed.40 This does not bar conviction of one who aids or abets the
commission of a crime that never succeeds beyond the attempt phase, if, as in the case of
paragraph 1030(a)(3), attempt to commit the offense has been made a separate crime.41

36 Whitfield v. United States, 543 U.S. 209, 214 (2005)(when in a conspiracy provision, Congress “omits any express
overt-act requirement, it dispenses with such a requirement”), quoting, United States v. Shabani, 513 U.S. 10, 14
(1994).
37 Congress has supplemented the general conspiracy prohibition with individual conspiracy provisions in a number of
instances in the past, e.g., 18 U.S.C. 32(a)(attempt or conspiracy to destroy aircraft or their facilities), 81 (attempt or
conspiracy to commit arson within the special maritime or territorial jurisdiction of the United States), 175 (attempt or
conspiracy to commit a biological weapons offense), 1512(k) (conspiracy to obstruct justice). Such conspiracies are
usually subject to the same penalties as the underlying substantive offense and that is likely what was intended when
the Identity Theft Enforcement and Restitution Act added the conspiracy prohibition to subsection 1030(b).
38 “(a) Whoever commits an offense against the United States or aids, abets, counsels, commands, induces or procures
its commission, is punishable as a principal.
“(b) Whoever willfully causes an act to be done which if directly performed by him or another would be an offense
against the United States, is punishable as a principal,” 18 U.S.C. 2; see generally, Blakey & Roddy, Reflections on
Reves v. Ernst & Young: Meaning and Impact on Substantive, Accessory, Aiding Abetting and Conspiracy Liability
Under RICO
, 33 AMERICAN CRIMINAL LAW REVIEW 1345, 1385-418 (1996); see also, United States v. Yakou, 393 F.3d
231, 242 (D.C. Cir. 2005)(“The statute typically applies to any criminal statute unless Congress specifically carves out
an exception that precludes aiding and abetting liability, and it long has been established that a person can be convicted
of aiding and abetting another person’s violation of a statute even if it would be impossible to convict the aider and
abettor as a principal”)(citations omitted).
39 United States v. Wilson, 619 F.3d 787, 797 (8th Cir. 2010)(“To establish ... that Wilson aided and abetted ... the
Government had to prove ... that Wilson (1) associated himself with the unlawful venture; (2) participated in it as
something he wished to bring about, and (3) sought by his actions to make it succeed”); United States v. George, 658
F.3d 706, 708 (7th Cir. 2011); United States v. Agosto-Vega, 617 F.3d 541, 552 (1st Cir. 2010); United States v.
Sabhnani
, 599 F.3d 215, 237 (2d Cir. 2010).
40 United States v. Reyes-Mendoza, 665 F.3d 165, 169 (5th Cir. 2011); United States v. Sutcliffe, 505 F.3d 944, 959 (9th
Cir. 2007); United States v. Gardner, 488 F.3d 700, 713 (6th Cir. 2007).
41 United States v. Washington, 106 F.3d 983, 1004-5 (D.C.Cir. 1997)(“If the principal had actually attempted to
(continued...)
Congressional Research Service
11

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Limited Application and State law
Beyond these auxiliary offenses and bases for criminal liability, the simple trespassing crime
created in paragraph 1030(a)(3) is the least likely of the seven crimes established in subsection
1030(a) to share coverage with other laws outside the section. Simply hacking into government
computers—without damage to the system, injury to the government, or gain by the hacker—
implicates only a few other laws. Computer trespassing in one form or another is an element of
most of the offenses proscribed in 18 U.S.C. 1030. Moreover, hacking into someone else’s e-mail
stored in a government computer system is likely to offend the federal statute that protects e-mail
and stored telephone company records, 18 U.S.C. 2701.42 Hackers who misidentify themselves in
order to gain access to a federal computer may be guilty of violating 18 U.S.C. 100143 and 18

(...continued)
commit a crime but had failed, the aider and abettor would be charged with the same offense as the principal (attempt
to commit the crime)”). See also United States v. Villanueva, 408 F.3d 193, 202 (5th Cir. 2005) (finding defendant
guilty of aiding and abetting an attempted crime); United States v. Gardner, 488 F.3d 700, 711 (6th Cir. 2007)(aiding
and abetting attempted possession of cocaine).
42 “(a) Offense.B Except as provided in subsection (c) of this section whoever – (1) intentionally accesses without
authorization a facility through which an electronic communication service is provided; or (2) intentionally exceeds an
authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic
communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this
section.
“(b) Punishment.B The punishment for an offense under subsection (a) of this section isB (1) if the offense is
committed for purposes of commercial advantage, malicious destruction or damage, or private commercial gain or in
furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or any StateB (A)
a fine under this title or imprisonment for not more than 5 years, or both, in the case of a first offense under this
subparagraph; and (B) a fine under this title or imprisonment for not more than 10 years, or both, for any subsequent
offense under this subparagraph; and (2) in any other caseB (A) a fine under this title or imprisonment for not more than
1 year or both, in the case of a first offense under this paragraph; and (B) a fine under this title or imprisonment for not
more than 5 years, or both, in the case of an offense under this subparagraph that occurs after a conviction of another
offense under this section.
“(c) Exceptions.B Subsection (a) of this section does not apply with respect to conduct authorized B (1) by the
person or entity providing a wire or electronic communications service; (2) by a user of that service with respect to a
communication of or intended for that user; or (3) in section 2703, 2704 or 2518 of this title,” 18 U.S.C. 2701.
The provisions of 18 U.S.C. 2511 (wiretapping) may apply to the unlawful interception of e-mail transmissions
while in transit and 18 U.S.C. 2701 may apply to the unlawful seizure of stored e-mail. Offenses under §2511 are
punishable by imprisonment for not more than 5 years as well, 18 U.S.C. 2511(4).
43 “(a) Except as otherwise provided in this section, whoever, in any matter within the jurisdiction of the executive,
legislative, or judicial branch of the Government of the United States, knowingly and willfully—(1) falsifies, conceals,
or covers up by any trick, scheme, or device a material fact; (2) makes any materially false, fictitious, or fraudulent
statement or representation; or (3) makes or uses any false writing or document knowing the same to contain any
materially false, fictitious, or fraudulent statement or entry; shall be fined under this title or imprisoned not more than 5
years or, if the offense involves international or domestic terrorism (as defined in section 2331), imprisoned not more
than 8 years, or both.
“(b) Subsection (a) does not apply to a party to a judicial proceeding, or that party’s counsel, for statements,
representations, writings or documents submitted by such party or counsel to a judge or magistrate in that proceeding.
“(c) With respect to any matter within the jurisdiction of the legislative branch, subsection (a) shall apply only to—
(1) administrative matters, including a claim for payment, a matter related to the procurement of property or services,
personnel or employment practices, or support services, or a document required by law, rule, or regulation to be
submitted to the Congress or any office or officer within the legislative branch; or (2) any investigation or review,
conducted pursuant to the authority of any committee, subcommittee, commission or office of the Congress, consistent
with applicable rules of the House or Senate,” 18 U.S.C. 1001; see generally, Twenty-Sixth Survey of White Collar
Crime: False Statements and False Claims
, 48 AMERICAN CRIMINAL LAW REVIEW 629 (2011).
Congressional Research Service
12

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

U.S.C. 912,44 in the view of at least one commentator.45 The case law may make the claim
difficult to defend. The Supreme Court has suggested that §1001 should be constructed
narrowly,46 and the courts have consistently held that the false statement must somehow tend to
adversely impact the functioning of a governmental agency or department to trigger coverage
under Section 1001.47 Cases in other contexts demonstrate the difficulty of convincing the courts
that simple trespassing in government cyberspace has an adverse impact upon the government.48
The difficulty with using the impersonation statute, 18 U.S.C. 912, is that it requires a showing of
an official act or of a fraud; something that need not be proven for conviction under paragraph
1030(a)(3).49 Like 18 U.S.C. 1001, §912 may be more appropriately employed in cases falling
under the ambit of paragraph 1030(a)(4) (unauthorized access of a government computer, bank
computer, or computer in interstate or foreign commerce as integral part of a scheme to fraud).
Simple computer trespassing is also a crime under the anti-hacking laws of most of the states.50

44 “Whoever falsely assumes or pretends to be an officer or employee acting under the authority of the United States or
any department, agency or officer thereof, and acts as such, or in such pretended character demands or obtains any
money, paper, document, or thing of value, shall be fined under this title or imprisoned not more than three years, or
both,” 18 U.S.C. 912.
45 Olivenbaum, <CTRL><ALT><DELETE>: Rethinking Federal Computer Legislation, 27 SETON HALL LAW REVIEW
574, 600 (1997)(citing an instance from the infancy of §1030 where a hacker was indicted under the false statement, 18
U.S.C. 1001, and wire fraud, 18 U.S.C. 1343, statute. The case ended when the defendant pled to a misdemeanor fraud
charge). No comparable prosecutions followed and so the author’s thesis remains unproven.
46 Hubbard v. United States, 514 U.S. 695 (1995)(overturning an earlier holding that §1001 applied to false statements
made to federal courts and to Congress as well as those made to the executive branch)(superseded by statute, P.L. 104-
292, 110 Stat. 3459 (1996)(the modification preserved the exception that it did not apply “to a party to a judicial
proceeding, or that party’s counsel, for statements, representations, writings or documents submitted by such party or
counsel to a judge or magistrate in that proceeding.”)(§1001(b)); United States v. Gaudin, 515 U.S. 509 (1995)(holding
that materiality of the false statement, as an element of §1001, is a question for the jury to decide).
47 United States v. Gaudin, 515 U.S. 506, 509 (1995)(“[T]he statement must have a natural tendency to influence, or be
capable of influencing the decision of the decision-making body to which it was addressed”); United States v. Baker,
200 F.3d 558, 561 (8th Cir. 2000) (“The materiality inquiry focuses on whether the false statement had a natural
tendency to influence or was capable of influencing the government agency or official”). United States v. Mitchell, 388
F.3d 1139, 1143 (8th Cir. 2004) (noting that a false statement must have “a natural tendency to influence or is capable
of influencing the government agency or official” and that “[m]ateriality does not require proof that the government
actually relied on the statement”); but see, United States v. Safavian, 649 F.3d 688, 691 (D.C. Cir. 2011)(“[A]
statement need not actually influence an agency in order to be material; it need only have a natural tendency to
influence or be capable of influencing an agency function or decision”).
48 United States v. Collins, 56 F.3d 1416 (D.C.Cir. 1995) and United States v. Czubinski, 106 F.3d 1069 (1st Cir. 1997),
overturned convictions under 18 U.S.C. 641 (theft of government property), and 18 U.S.C. 1343 (wire fraud) and
1030(a)(4)(computer fraud) respectively, on the ground that the prosecution had failed to show any adverse impact
upon the government caused by the defendant’s unauthorized access of government computer files.
49 “Whoever ... pretends to be an officer ... acting under the authority of the United States ... and acts as such, or in
such pretended character demands or obtains any ... thing of value
,” 18 U.S.C. 912 (emphasis added).
50 ALA.CODE §13A-8-102; ALASKA STAT. §11.46.484; ARIZ.REV.STAT.ANN. §13-2316; ARK.CODE ANN. §5-41-104;
CAL. PENAL CODE §502; COLO.REV.STAT. ANN. §18-5.5-102; CONN.GEN.STAT.ANN. §53a-251; DEL.CODE ANN. tit.11
§932; FLA.STAT.ANN. §815.06; HAWAII REV.STAT. §§708-895.5 to 708-895.7; IDAHO CODE §18-2202; ILL.COMP.
STAT.ANN. ch.720 §5/16D-3; IND.CODE ANN. §35-43-2-3; IOWA CODE ANN. §716.6B; KAN. STAT.ANN. §21-3755(d);
KY.REV.STAT.ANN. §434.853; LA.REV.STAT.ANN. §14:73.7; ME.REV.STAT.ANN. tit.17-A §432; MD.CRIM.CODE ANN.
§7-302; MASS.GEN. LAWS ANN. ch.266 §120F; MINN.STAT.ANN. §609.891; MO.ANN.STAT. §569.099; MONT.CODE
ANN. §45-6-311; NEB.REV.STAT. §28-1347; NEV. REV.STAT. §§205.4765, 205.477; N.H. REV.STAT.ANN. §638:17; N.J.
STAT.ANN. §2C:20-25; N.Y. PENAL LAW §156.05; N.C.GEN. STAT. §14-454; OHIO REV. CODE ANN. §2913.04(B);
OKLA.STAT.ANN. tit.21 §1953; ORE.REV.STAT. §164.377; R.I.GEN. LAWS §11-52-3; S.C.CODE ANN. §16-16-20(4);
S.D.COD.LAWS §43-43B-1; TENN.CODE ANN. §39-14-602; TEX.PENAL CODE ANN. §33.02; UTAH CODE ANN. §76-6-
(continued...)
Congressional Research Service
13

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Obtaining Information by Unauthorized Computer
Access (18 U.S.C. 1030(a)(2))

(a) Whoever ... (2) intentionally accesses a computer without authorization or exceeds
authorized access, and thereby obtains
B
(A) information contained in a financial record of a financial institution, or of a card
issuer as defined in Section 1602(n) of title 15,51 or contained in a file of a consumer
reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting
Act (15 U.S.C. 1681 et seq.);52

(B) information from any department or agency of the United States; or
(C) information from any protected computer ...
shall be punished as provided in subsection (c) of this section.
(b) Whoever attempts to commit an offense under subsection (a) of this section shall be
punished as provided in subsection (c) of this section.

One step beyond simple hacking is the prohibition against acquiring certain protected information
by intentional unauthorized computer access.53 As a practical matter, in any instance involving a

(...continued)
703; VT.STAT. ANN. tit.13 §4102; WASH. REV.CODE ANN. §9A.52.120; W.VA.CODE ANN. §61-3C-5; WIS. STAT.ANN.
§943.70; WYO. STAT. §6-3-504. Analysis of state law is generally beyond the scope of this report.
Members of the military may also incur liability under the Uniform Code of Military Justice for various forms of
computer abuse. See United States v. Wiest, 59 M.J. 276 (Ct. App. Armed Forces 2004) (reversing lower court on other
grounds) in which an Air Force Academy cadet was convicted of a violation of Article 134 of the Uniform Code of
Military Justice, for accessing a protected computer without authorization and recklessly damaging a computer in
violation of 18 U.S.C. §1030(a)(5)(B)). See also, United States v. Mervine, 26 M.J. 482 (1988)(suggesting that various
computer crimes might be charged under Article 134, the general article: “Though not specifically mentioned in this
chapter, all disorders and neglects to the prejudice of good order and discipline in the armed forces, all conduct of a
nature to bring discredit upon the armed forces, and crimes and offenses not capital, of which persons subject to this
chapter may be guilty, shall be taken cognizance of by a general, special, or summary court-martial, according to the
nature and degree of the offense, and shall be punished at the discretion of that court”).
51 “The term ‘card issuer’ means any person who issues a credit card, or the agent of such person with respect to such
card,” 15 U.S.C. 1602(n).
“The term ‘person’ means a natural person or an organization. The term ‘organization’ means a corporation,
government or governmental subdivision or agency, trust, estate, partnership, cooperative, or association. The term
‘credit card’ means any card, plate, coupon book or other credit device existing for the purpose of obtaining money,
property, labor, or services on credit. The term ‘credit’ means the right granted by a creditor to a debtor to defer
payment of debt or to incur debt and defer its payment.
“The term ‘creditor’ refers only to a person who both (1) regularly extends, whether in connection with loans, sales
of property or services, or otherwise, consumer credit which is payable by agreement in more than four installments or
for which the payment of a finance charge is or may be required, and (2) is the person to whom the debt arising from
the consumer credit transaction is initially payable on the face of the evidence of indebtedness or, if there is no such
evidence of indebtedness, by agreement. Notwithstanding the preceding sentence, in the case of an open-end credit plan
involving a credit card, the card issuer and any person who honors the credit card and offers a discount which is a
finance charge are creditors ...” 15 U.S.C. 1602(d), (c),(k), (e), and (f), respectively.
52 “The term ‘file’, when used in connection with information on any consumer, means all of the information on that
consumer recorded and retained by a consumer reporting agency regardless of how the information is stored.
“The term ‘consumer reporting agency’ means any person which, for monetary fees, dues, or on a cooperative
nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit
information or other information on consumers for the purpose of furnishing consumer reports to third parties, and
which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.
“The term ‘consumer’ means an individual,” 15 U.S.C. 1681a(g), (f) and (c), respectively.
53 “To prove a violation of [subparagraph 1030](a)(2)(C), the Government must show that the defendant (1)
intentionally accessed a computer, (2) without authorization (or exceeding authorized access), (3) and thereby obtained
(continued...)
Congressional Research Service
14

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

government computer it may be very difficult to distinguish between cases evidencing a violation
of the simple trespass proscriptions of paragraph 1030(a)(3) and the trespassing-with-
information-acquisition prohibitions of paragraph 1030(a)(2). The history of the trespass
provisions speaks clearly of an intent to place beyond their reach whistleblowers and other federal
employees for simple trespassing with respect to computers within their own agency. This
explains the absence of an “exceeds-authorized-access” provision in the trespassing provisions of
paragraph 1030(a)(3). But the trespass-and-be-exposed-to-information provisions of paragraph
1030(a)(2) do feature a “exceeds-authorized-access” clause and seem facially applicable to
whistleblowers. It remains to be seen whether the courts will read paragraph 1030(a)(2) as
effectively amending the simple trespassing provisions of paragraph 1030(a)(3) or will attempt to
reconcile the two.
Intent
The intent requirement is the same as that required in the case of simple trespassing. The offender
must have “intentionally” gained access. The paragraph only bans “intentional” trespassing. As in
the case of simple trespassing the intent element can be satisfied by anyone who purposefully
gains access to a computer covered by the paragraph or by anyone “whose initial access was
inadvertent but who then deliberatively maintains access after a non-intentional initial contact.”54
The government, however, need not show that the trespass was committed to defraud or for any
other purpose for that matter.55
Unauthorized Access
Thus far, the courts have experienced some difficulty applying the terms “without authorization”
and “exceeds authorized access” as used in paragraph 1030(a)(2) and the other paragraphs of 18
U.S.C. 1030, even though the statute supplies a specific definition of the term “exceeds
authorized access.”56 Some have applied the terms to access by authorized employees who use
their access in any unauthorized manner or for unauthorized purposes and to access by outsiders
who have been granted access subject to explicit reservations.57 Others have concluded that “a

(...continued)
information from any protected computer if the conduct involved interstate or foreign communication,” United States v.
Willis
, 476 F.3d 1121, 1125 (10th Cir. 2007); Ticketmaster L.L.C. v. RMG Technologies, Inc., 507 F.Supp.2d. 1096,
1113 (C.D. Cal. 2007). The third element of the offense becomes – “thereby obtained information from a financial
institution” or “thereby obtained information from a federal agency” – when the violation involves subparagraphs
1030(a)(2)(A)(relating to obtaining financial institution information) or 1030(a)(2)(B)(relating to obtaining federal
agency information).
54 H.Rept. 99-612 at 9-10 (1986); see also, S.Rept. 99-432 at 5-6 (1986)(“[S]uch conduct ... must have been the
person’s conscious objective”); Butera & Andrews v. IBM, Inc., 456 F.Supp.2d 104, 110 (D.D.C. 2006); United States
v. Drew
, 259 F.R.D. 449, 459 (C.D.Cal. 2009), quoting United States v. Willis, 476 F.3d 1121, 1125 (10th Cir.
2007)(“Under §1030(a)(2)(C), the ‘requisite intent’ is ‘to obtain unauthorized access of a protected computer’”).
55 United States v. Willis, 476 F.3d 1121, 1125 (10th Cir. 2007).
56 18 U.S.C. 1030(e)(6)(“[T]he term ‘exceeds authorized access’ means to access a computer with authorization and to
use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter”).
57 United States v. John, 597 F.3d 263, 270-73 (5th Cir. 2010); Shurgard Storage Centers v. Safeguard Self Storage, 119
F. Supp. 2d 1121, 1124-125 (W.D. Wash. 2000) (unauthorized access found when employees used their access to
benefit a competitor); YourNetDating v. Mitchell, 88 F. Supp. 2d 870, 872 (N.D. Ill. 2000) (former employee found to
be exceeding authorized access because he used his access codes to divert users from his ex-employer’s website).
Southwest Airlines Co. v. Farecase, Inc., 318 F.Supp.2d 435, 439-40 (N.D. Tex. 2004) (use of software to gather fare
(continued...)
Congressional Research Service
15

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

person who ‘intentionally accesses a computer without authorization’ §§1030(a)(2) and (4),
accesses a computer without any permission at all, while a person who ‘exceeds authorized
access,’ id., has permission to access the computer, but accesses information on the computer that
the person is not entitled to access.”58 One court concluded that the conscious breach of
MySpace’s terms of service could “potentially constitute accessing the MySpace computer/server
without authorization and/or in excess of authorization.”59 The court, however, went on to find
the section unconstitutionally vague under such a construction, “if any conscious breach of a
website’s terms of service is held to be sufficient by itself to constitute intentionally accessing a
computer without authorization or in excess of authorization, the result will be that section
1030(a)(2)(C) becomes a law ‘that affords too much discretion to the police and too little notice
to citizens who whish to use the [Internet].’”60
Obtaining Information and Jurisdiction
Paragraph 1030(a)(2) is at once more and less restricted than the simple trespassing proscription
of paragraph 1030(a)(3). On one hand, its prosecution requires more than a simple trespass.61 On
the other hand, it covers a wider range of computers. Paragraph 1030(a)(2), unlike 1030(a)(3),
covers more than government computers. It covers computers from which three types of
information may be obtained—information of the federal government, consumer credit or other
kinds of financial information, and information acquired from a protected computer.
The protection for financial information has its origins in the initial legislation and was among the
first adjusted. Comments from the Senate report accompanying the 1986 amendments illustrate
the intended scope of the protection for financial information:
“The premise of 18 U.S.C. 1030(a)(2) will remain the protection, for privacy reasons, of
computerized credit records and computerized information relating to customers’
relationships with financial institutions. This protection is imperative in light of the sensitive
and personal financial information contained in such computer files. However, by referring
to the Right to Financial Privacy Act, the current statute limits its coverage to financial
institution customers who are individuals, or are partnerships with five or fewer partners.
The Committee intends ... to extend the same privacy protections to the financial records of
all customers – individual, partnership, or corporate – of financial institutions.
“The Department of Justice has expressed concerns that the term ‘obtains information’ in 18
U.S.C. 1030(a)(2) makes that subsection more than an unauthorized access offense, i.e., that
it might require the prosecution to prove asportation of the data in question. Because the

(...continued)
information from airline’s website in spite of “no scraping” warnings constitutes a violation of paragraph 1030(a)(2)).
58 LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1133 (9th Cir. 2009); Lewis-Burke Assoc. LLC, 725 F.Supp.2d 187,
192-93 (D.D.C. 2010); US Bioservices Corp. v. Lugo, 595 F.Supp.2d 1189, 1192 (D.Kan. 2009)(citing cases on either
side of the divide); Bell Aerospace Services, Inc. v. U.S. Aero Services, Inc., 690 F.Supp.2d 1267, 1272 (M.D.Ala.
2010)(“‘Exceeds authorized access’ should not confused with exceeds authorized use”).
59 United States v. Drew, 259 F.R.D. 449, 461 (C.D.Cal. 2009).
60 Id. at 467, quoting Chicago v. Morales, 527 U.S. 41, 64 (1999).
61 Yet it may not require a great deal more than a paragraph 1030(a)(3) prosecution, since merely viewing material on a
computer screen has been found to constitute obtaining information for purposes of paragraph 1030(a)(2), Healthcare
Advocates, Inc. v. Harding, Early, Follmer & Frailey
, 497 F.Supp.2d 627, 648 (E.D. Pa. 2007), citing S.Rept. 99-432
at 6-7 (1986).
Congressional Research Service
16

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

premise of this subsection is privacy protection, the Committee wishes to make clear that
‘obtaining information’ in this context includes mere observation of the data. Actual
asportation, in the sense of physically removing the data from its original location or
transcribing the data, need not be proved in order to establish a violation of this subsection,”
S.Rept. 99-432 at 6-7 (1986).
The committee explanation of the language amending paragraph 1030(a)(2), ultimately enacted as
part of the Economic Espionage Act of 1996, endorsed this reading and extended it to cover
information obtained from federal computers and information secured by interstate or overseas
cyberspace trespassing:
“‘Information’ as used in this subsection [1030(a)(2)] includes information stored in
intangible form. Moreover, the term ‘obtaining information’ includes merely reading it.
There is no requirement that the information be copied or transported. This is critically
important because, in an electronic environment, information can be ‘stolen’ without
asportation, and the original usually remains intact. This interpretation of ‘obtaining
information’ is consistent with congressional intent expressed ... in connection with 1986
amendments to the Computer Fraud and Abuse statute....
“The proposed subsection 1030(a)(2)(C) is intended to protect against the interstate or
foreign theft of information by computer. This information, stored electronically, is
intangible, and it has been held that the theft of such information cannot be charged under
more traditional criminal statutes such as Interstate Transportation of Stolen Property Act, 18
U.S.C. 2314. See United States v. Brown, 925 F.2d 1301, 1308 (10th Cir. 1991). This
subsection would ensure that the theft of intangible information by the unauthorized use of a
computer is prohibited in the same way theft of physical items are protected. In instances
where the information stolen is also copyrighted, the theft may implicate certain rights under
the copyright laws. The crux of the offense under subsection 1030(a)(2)(C), however, is the
abuse of a computer to obtain the information,” S.Rept. 104-357 at 6-7 (1996).
The Identity Theft Enforcement and Restitution Act of 2008 expanded the reach of paragraph
1030(a)(2) when it eliminated the requirement that the forbidden access “involve[] an interstate or
foreign communication”62 and when it redefined “protected computer” to include computers
“affecting” interstate or foreign commerce. The elimination permits authorities to “address the
increasing number of computer hacking crimes that involve computers located within the same
state.”63 The expansion from computers used in interstate or foreign commerce to computers
used in or affecting such commerce extends coverage beyond computers with an interstate
Internet connection and appears to encompass any freestanding or other computer that has at least
a de minimis impact on commerce.64

62 The deleted phrase required “that the conduct of unlawfully accessing a computer, and not the obtained information
... involve an interstate or foreign communication,” Patrick Patterson Custom Homes v. Bach, 586 F.Supp.2d 1026,
1033 (N.D.Ill. 2008).
63 153 Cong. Rec. S14570 (daily ed. November 15, 2007)(remarks of Sen. Leahy).
64 The courts have generally held that only a slight impact on commerce is necessary to satisfy an offense’s “affect on
interstate or foreign commerce” element, United States v. Kincaid-Chauncey, 556 F.3d 923, 936 (9th Cir. 2009); United
States v. Mejia
, 545 F.3d 179, 203 (2d Cir. 2008); United States v. DeCologero, 53 F.3d 36, 37-8 (1st Cir. 2008); cf.,
Gonzales v. Raich, 545 U.S. 1, 17 (2005)(internal quotation marks omitted)(“[W]hen a general regulatory statute bears
a substantial relation to commerce, the de minimis character of individual instances arising under that statute is of no
consequences”). §207 of the Identity Theft Enforcement and Restitution Act added “or affecting” to the definition of
“protected computer,” P.L. 110-326, 122 Stat. 3563 (2008). Before the amendment, when the definition was confined
to computers “used in interstate or foreign commerce or communication,” the courts had concluded that “a computer
that provides access to worldwide communications through applications accessible through the internet qualifies as a
(continued...)
Congressional Research Service
17

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

The earlier USA PATRIOT Act amendment of the definition of “protected computer” confirmed
Congress’s intent to proscribe unauthorized access and information acquisition from abroad with
respect to protected computers.65 A closer question may be whether in doing so it forecloses
extraterritorial application of paragraph 1030(a)(2) in other situations, for example, unauthorized
access to federal computer or computer networks located overseas.
Consequences
The simple trespass offenses condemned in paragraph 1030(a)(3) are unlikely to significantly
implicate the Sentencing Guidelines, restitution, forfeiture, or civil liability provisions elsewhere
in the law. Not so paragraph 1030(a)(2) offenses. Criminal penalties attend it, but so do other
consequences.
Penalties
Paragraph 1030(a)(2) has a three tier sentencing structure. Simple violations are punished as
misdemeanors, imprisonment for not more than one year and/or a fine of not more than $100,000
($200,000 for organizations).66
The second tier carries penalties of imprisonment for not more than five years and/or a fine of not
more $250,000 ($500,000 for organizations) and is reserved for cases in which “(i) the offense
was committed for purposes of commercial advantage or private financial gain; (ii) the offense
was committed in furtherance of any criminal or tortious act in violation of the Constitution or
laws of the United States or of any State; or (iii) the value of the information obtained exceeds
$5,000.”67
This second level was added in 1996. With respect to the alternative thresholds, (i) and (ii), “[t]he
terms ‘for purposes of commercial advantage or private financial gain’ and ‘for the purpose of
committing any criminal or tortious act’ are taken from the copyright statute (17 U.S.C. 506(a))
and the wiretap statute (18 U.S.C. 2511[(2)] (d)), respectively, and are intended to have the same
meaning as in those statutes.”68 The references to copyright and wiretap law may be less
instructive than Congress anticipated for the phrases in question are of uncertain meaning in their
original settings.69 Nevertheless, the phrases clearly contemplate some criminal, tortious, or

(...continued)
protected computer,” Patrick Patterson Custom Homes, Inc. v. Bach, 586 F.Supp.2d 1026, 1032 (N.D. Ill. 2008).
65 “As used in this section ... (2) the term ‘protected computer’ means a computer ... (B) which is used in or affecting
interstate or foreign commerce or communication, including a computer located outside the United States that is
used in a manner that affects interstate or foreign commerce or communication of the United States
,” 18
U.S.C. 1030(e)(2)(B)(language of the USA PATRIOT Act amendment in enlarged italics; 2008 amendment in regular
italics).
66 18 U.S.C. 1030(c)(2)(A), 3571.
67 18 U.S.C. 1030(c)(2)(B), 3571.
68 S.Rept. 104-357 at 8 (1996).
69 4 NIMMER & NIMMER, NIMMER ON COPYRIGHT §15.01 n.1.2 (1997) (emphasis added)(“Apparently, the phrase
‘commercial advantage or private financial gain’ is intended as the equivalent of ‘for profit’”); 1 FISHMAN &
MCKENNA, WIRETAPPING AND EAVESDROPPING, THIRD EDITION §3:38 (2010) comparing, Stockler v. Garratt, 893 F.2d
856 (6th Cir. 1990), with, By-Product Corp. v. Armen-Berry Co., 668 F.2d 956 (7th Cir. 1982)(in disagreement over
whether an offender must act upon his or her criminal or tortious purpose after recording a conversation to which they
(continued...)
Congressional Research Service
18

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

financially advantageous purpose beyond the computer-trespassing-and-obtaining-information
misconduct outlawed in the paragraph generally. Otherwise nothing would be left to be punished
as a misdemeanor and the $5,000 distinction of exception (iii) would be swallowed up as well.
As for exception (iii), the value of information acquired by a hacker may always be easily
ascertained. In the absence of evidence of fair market value, one appellate court approved the
district court’s use of the cost of production to assess the value of information acquired in
violation of subsection 1030(a)(2).70 It suggested, however, any calculation reasonable under the
circumstances might be acceptable.71
The third tier is for repeat offenders whose punishment is increased to imprisonment of not more
than 10 years and/or a fine of not more than $250,000 ($500,000 for organizations) for a second
or subsequent conviction.72
Federal law is no more hospitable to the prosecution of juveniles for the intrusion plus
information acquisition offenses under paragraph 1030(a)(2) than it is for the simple trespass
offenses under paragraph 1030(a)(3). Essentially, federal proceedings are only possible if the state
in which the offense occurs is unwilling or unable to proceed.73
Sentencing Guidelines
The Sentencing Guidelines color the procedure under which the penalties for serious federal
crimes are imposed.74 They were established to eliminate sentencing disparity among cases
involving the same offense and to ensure that the sentences imposed reflect the relative
seriousness of the circumstances under which the offense was committed in a given case.75 As a

(...continued)
are a party or where one party to the conversation has consented to the recording).
70 United States v. Batti, 631 F.3d 371, 378 (6th Cir. 2011).
71 Id. (“With this approach in mind, we believe that, where information obtained by a violation of §1030(c)(2)(B)(iii)
does not have a readily ascertainable market value, it is reasonable to use the cost of production as a means to
determine the value of the information obtained. . . . §1030(a)(2)(C) protects, broadly, ‘information [obtained] from any
protected computer,’ and it is often the case, as it was here, that this information is intangible and lacks any easily
ascertainable market value. In such circumstances, we approve of the use of ‘any reasonable method’ to determine the
value of information obtained by a breach . . . . We recognize, however, that, given the broad nature of the statute,
violations of §1030(a)(2)(C) may arise in many different contexts. We therefore express no opinion regarding either the
propriety of other methods by which to calculate the value of information obtained under 18 U.S.C. §1030(a)(2)(C) and
(c)(2)(B)(iii) or the applicability of the method we approve today to dissimilar factual circumstances”).
72 18 U.S.C. 1030(c), 3571.
73 18 U.S.C. 5032.
74 At one time, federal sentencing courts were essentially bound by the Guidelines, 18 U.S.C. 3553(b)(1). Booker
changed that, see United States v. Booker, 543 U.S. 220, 245 (2005)(“We answer the question of remedy by finding the
provision of the federal sentencing statute that makes the Guidelines mandatory, 18 U.S.C.A. 3553(b)(1)(Supp. 2004),
incompatible with today’s constitutional holding. We conclude that this provision must be severed and excised....”).
Now, federal sentencing courts must begin by identifying the appropriate sentencing range under the Guidelines, but
enjoy discretion to make justifiable reasonable departures, Gall v. United States, 552 U.S. 38, 49-53 (2007). The
Identity Theft Enforcement and Restitution Act directed the United States Sentencing Commission to re-examine, for
consistency with the tenor of the act, the sentencing guidelines and policy statements applicable to those convicted of
violations of §1030 as well as those convicted of violating 18 U.S.C. 1028 (identity fraud), 1028A (aggravated identity
theft), 2511 (wiretapping), and 2701 (stored electronic communications and communications records), §209, P.L. 110-
326, 122 Stat. 3564 (2008).
75 S.Rept. 98-225, at 50-2 (1983).
Congressional Research Service
19

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

general rule, the Guidelines assign each federal crime to a particular guideline.76 The individual
guideline in turn assigns a beginning number (base offense level) and then adds and subtracts
from that number based on the presence of designated aggravating or mitigating circumstances.77
The final total translates to an authorized sentencing range in months of imprisonment and dollars
of fines.78
Violations of paragraph 1030(a)(2) are governed by U.S.S.G. §2B1.1 which sets the base offense
level at 6. The Tenth Circuit’s opinion in Willis provides an example of the process from that
point:
The District Court agreed with the Government and found Ms. Fischer’s conduct [which
resulted in losses of more than $10,000] foreseeable to [her accomplice] Mr. Willis. It
therefore imposed a 4-level enhancement on Mr. Willis’s base offense level.79
It also applied the §2B1.1(b)(10)(C)(i) enhancement because the offense involved using a
means of identification to produce another means of identification,80as well as the §3B1.3
enhancement because Mr. Willis abused a position of trust.81 This produced an adjusted
offense level of 14, which when coupled with his criminal history category of V, resulted in
an advisory Guideline range of 33 to 41 months. The District Court sentenced Mr. Willis to
41 months’ imprisonment.82
Although not mentioned in Willis, the Guidelines now add 2-6 offense levels if the offense
involves a critical infrastructure computer83 and 2 levels if the information acquired is personal
information.84

76 U.S.S.G. §§1B1.1, 8A1.2.
77 Id.
78 U.S.S.G. ch.5, pt.A, §5E1.2, ch.8 pt.C.
79 United States v. Willis, 476 F.3d 1121, 1127-128 (10th Cir. 2007), citing U.S.S.G. §2B1.1(b)(1)(C). Paragraph
2B1.1(b)(1) instructs a sentencing court to increase to an offender’s offense level under §2B1.1 according to the
amount of the loss associated with the offense. In Mr. Willis’s case, the loss was more than $10,000 but less than
$30,000. Had it been more than $30,000 but less than $70,000 an increase of 6 would have been appropriate. The
enhancements are calibrated to account for losses from $5,000 (add 2) to more than $4 million (add 30).
80 Id. at 1128. U.S.S.G. §2B1.1(b)(10)(C)(i) states, “If the offense involved ...(C)(i) the unauthorized transfer or use of
any means of identification unlawfully to produce or obtain any other means of identification ... increase by 2 levels.”
Mr. Willis had given Ms. Fischer a username and password that gave her unauthorized access to a financial information
database, which she used in an identity theft scheme.
81 Id. U.S.S.G. §3b1.3 states, “If the defendant abused a position of public or private trust, or used a special skill, in a
manner that significantly facilitated the commission or concealment of the offense, increase by 2 levels.” Mr. Willis
acquired in his position as supervisor in a debt collection agency the username and password which he had then passed
on to his accomplice. Although not implicated here, the special skill enhancement is often implicated in the offenses
outlawed in the various paragraphs of 18 U.S.C. 1030.
82 Id. Mr. Willis had a fairly extensive record of previous convictions. Had he been a first time offender, his criminal
history category would have been I and his sentencing range at an offense level of 14 would have been 15 to 21
months, U.S.S.G. Ch.5, Pt. A (Sentencing Table).
83 U.S.S.G. §2B1.1(b)(17)(“(A)(Apply the greatest) If the defendant was convicted of an offense under: (i) 18 U.S.C.
§1030, and the offense involved a computer system used to maintain or operate a critical infrastructure, or used by or
for a government entity in furtherance of the administration of justice, national defense, or national security, increase
by 2 levels. (ii) 18 U.S.C. §1030(a)(5)(A), increase by 4 levels. (iii) 18 U.S.C. §1030, and the offense caused a
substantial disruption of a critical infrastructure, increase by 6 levels. (B) If subdivision (A)(iii) applies, and the offense
level is less than level 24, increase to level 24”).
84 U.S.S.G. §2B1.1(b)(16)(“If (A) the defendant was convicted of an offense under 18 U.S.C. §1030, and the offense
involved an intent to obtain personal information . . . increase by 2 levels”).
Congressional Research Service
20

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Forfeiture
Under the general forfeiture provisions, “[a]ny property, real or personal, which constitutes or is
derived from proceeds traceable, to a violation of section ... 1030” is subject to confiscation by
the United States under either the general civil or criminal forfeiture provisions.85 The Identity
Theft Enforcement and Restitution Act of 2008 inserted separate criminal and civil forfeiture
subsections within §1030.86 Section 1030 now authorizes confiscation pursuant to criminal
procedure both real and personal property derived from a violation of §1030,87 as well as any
personal property used or intended to be used to facilitate such a violation.88
Restitution
Restitution is victim compensation for loss or damage associated with the offense.89 Federal
courts must order a convicted defendant to pay restitution in the case of any federal crime of
violence or federal crime involving fraud or property damage.90 It is within the discretion of the
court to order restitution in the case of all other federal crimes proscribed in Title 18 of the United
States Code
.91
Paragraph 1030(a)(2) acquisition offenses are not crimes of violence and restitution is therefore
not mandatory. They come within the discretionary restitution provisions, but those provisions
have a limitation on the type of losses for which restitution may be ordered.92 The limitation,
however, does not apply in the case of a plea bargain93 or when restitution is ordered as a
condition of probation or supervised release.94

85 18 U.S.C. 981(a)(1)(C)(civil forfeiture); see also, 18 U.S.C 982(a)(2)(B)(criminal forfeiture)(“[A]ny property
constituting, or derived from proceeds the person obtained directly or indirectly, as the result of such violations”).
Criminal forfeiture is accomplished following the criminal prosecution of the property owner, 18 U.S.C. 982. Civil
forfeiture is accomplished through an in rem proceeding directed against the property itself, 18 U.S.C. 983. See
generally, CRS Report 97-139, Crime and Forfeiture.
86 18 U.S.C. 1030(i), (j).
87 18 U.S.C. 1030(i)(1)(B), 1030(j)(2).
88 18 U.S.C. 1030(i)(1)(A), 1030(j)(1).
89 See generally, CRS Report RL34138, Restitution in Federal Criminal Cases.
90 18 U.S.C. 3663A. E.g., United States v. Phillips, 477 F.3d 215, 224-25 (5th Cir. 2007)(restitution ordered for
violations of paragraph 1030(a)(5)(damage of a protected computer)).
91 18 U.S.C. 3663
92 “(b) The [restitution] order may require that such defendant – (1) in the case of an offense resulting in damage to or
loss or destruction of property of a victim of the offense – (A) return the property to the owner of the property or
someone designated by the owner; or (B) if return of the property under subparagraph (A) is impossible, impractical, or
inadequate, pay an amount equal to the greater of – (i) the value of the property on the date of the damage, loss, or
destruction, or (ii) the value of the property on the date of sentencing, less the value (as of the date the property is
returned) of any part of the property that is returned,” 18 U.S.C. 3663(b)(1).
93 18 U.S.C. 3663(a)(3).
94 18 U.S.C. 3563(b)(2), 3583(d)(3). Supervised release is a period of supervision to be served after an individual is
released from prison, 18 U.S.C. 3583(a).
Congressional Research Service
21

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Civil Cause of Action
Subsection 1030(g) creates a cause of action for compensatory damages and injunctive relief for
the benefit of victims of any §1030 violation, but only if violation results in the kind of loss or
damage described in clauses 1030(c)(4)(A)(i)(I) through (V),95 that is
(I) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation,
prosecution, or other proceeding brought by the United States only, loss resulting from a
related course of conduct affecting 1 or more other protected computers) aggregating at least
$5,000 in value;
(II) the modification or impairment, or potential modification or impairment, of the medical
examination, diagnosis, treatment, or care of 1 or more individuals;
(III) physical injury to any person;
(IV) a threat to public health or safety;
(V) damage affecting a computer system used by or for a government entity in furtherance
of the administration of justice, national defense, or national security.;
(VI) damage affecting 10 or more protected computers during any 1-year period.96
There is no need to prove that a violation of paragraph 1030(a)(5) has occurred. As long as this
type of loss or damage has been suffered, a violation of any of the paragraphs will suffice,
including a violation of paragraph 1030(a)(2).97 Moreover, some courts have held that victims
may join their losses together to reach the $5,000 threshold of subclause 1030(c)(4)(A)(i)(I), at
least as long as the same defendant caused the same damage in the same manner to each.98
At one time there may have been some uncertainty over the range of victims and losses
envisioned in subsection 1030(g). Victims entitled to relief are described as “any person who
suffers loss or damage by reason of a violation of this section,” but until recently there was no
specific definition of the term “person” in either any of the subsections of 1030 or in the generally
applicable definitions of Title 18.99 The legislative history offered no further edification and the

95 “Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against
the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation
of this section may be brought only if the conduct involves 1 of the factors set forth in subclauses (I), (II), (III), (IV), or
(V) of subsection (c)(4)(A)(i)....” 18 U.S.C. 1030(g).
96 18 U.S.C. 1030(c)(4)(A)(i). §204 of the Identity Theft Enforcement and Restitution Act of 2008 moved these
examples of serious damage to the sentencing provisions of clause 1030(c)(4)(A)(i) and added a damage-affecting-10-
or-more example, P.L. 110-326, 122 Stat. 3561-562 (2008). While harm to more than 10 computers triggers a more
severe criminal penalty, it alone does not provide the basis for a cause of action.
97 Theofel v. Farey-Jones, 359 F.3d 1066, 1078 n.5 (9th Cir. 2004)(“Defendants argue that subsection (a)(5)(A)
prescribes the act’s only civil offenses. But subsection (g) applies to any violation of ‘this section’ and, while the
offenses must involve one of the five factors in (a)(5)(B), it need not be one of three offenses in (a)(5)(A)”); Czech v.
Wall Street on Demand, Inc
., 674 F.Supp.2d 1102, 1108-109 (D. Minn. 2009); Bansal v. Russ, 513 F.Supp.2d 264, 278
n. 11 (E.D. Pa. 2007); America Online, Inc. v. National Health Care Discount, Inc., 174 F.Supp.2d 890, 899 (N.D.
Iowa 2001); cf., P.C. Yonkers, Inc. v. Celebrations, the Party, and Seasonal Superstore, LLC, 428 F.3d 504, 512 (3d
Cir. 2005)(reaching the same conclusion in the context of a suit under paragraph (a)(4)); Nexans Wires S.A. v. Sark-
USA, Inc.
, 319 F.Supp.2d 468, 472 (S.D.N.Y. 2004)(holding that plaintiffs must satisfy the 1030(a)(5)(B) threshold for
each of several claims under 1030(a)(2), (a)(4), and (a)(5)).
98 In re Apple & AT & TM Antitrust Litigation, 596 F.Supp.2d 1288, 1308 (N.D. Cal. 2008)(citing an earlier,
unreported district court opinion as persuasive).
99 The courts have concluded that the civil remedies under the statute are available to third parties. The court in Theofel
v. Farey-Jones
, 359 F.3d 1066, 1078 (9th Cir. 2004), emphasized that the statute extends a civil remedy to any
individual who suffers loss or damage, thus “[i]ndividuals other than the computer’s owner may be proximately harmed
by unauthorized access, particularly if they have rights to data stored on it.”
Congressional Research Service
22

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

courts had not addressed the issue. “Person” can mean individuals, or individuals and other legal
entities including governmental entities, or individuals and other legal entities but not including
governmental entities.100 Credible arguments might have been made for each of the possible
definitions, but the fact that Congress elected to use the term “person” to mean only individuals in
paragraph 1030(a)(7)(extortionate threats)101 might seem to favor those who call for a similar
interpretation of subsection 1030(g). The USA PATRIOT Act resolved the issue by supplying a
definition: “the term ‘person’ means any individual, firm, corporation, educational institution,
governmental entity, or legal or other entity.”102
It also added a generous definition of the kinds of losses that might give rise to civil liability—
“the term ‘loss’ means any reasonable cost to any victim, including the cost of responding to an
offense, conducting a damage assessment, and restoring the data, program, system, or information
to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential
damages incurred because of interruption of service.”103 The amendment has obvious benefits for
the victims of a paragraph (a)(2) intrusion and information acquisition offense with post-intrusion
investigation and system evaluation costs.
Subsection 1030(g) suits must be brought within two years of the offense.104 Compensatory
damages are limited to economic damages, a limitation that does not negate the reach of the broad
definition of the term “loss” quoted above.105
Attempt, Conspiracy, and Complicity
The same general observations concerning attempt, conspiracy, and aiding and abetting noted for
the simple trespass offense apply here. It is a separate crime to attempt or conspire to violate
paragraph 1030(a)(2) under 18 U.S.C. 1030(b). Those who conspire or attempt to violate its
provisions or aid and abet the violation of another are subject to the same penalties as those who
commit the substantive offense.106 Conspirators to violate paragraph 1030(a)(2) are also subject
to the same penalties for a completed underlying offense, and to liability for any foreseeable
crime committed in furtherance of the scheme.107

100 The Dictionary Act, for example, defines the term to include “corporations, associations, firms, partnerships,
societies, and joint stock companies, as well as individuals,” unless the context suggests otherwise, 1 U.S.C. 1.
101 “Whoever ... (7) with intent to extort from any person, firm, association, educational institution, financial
institution, government entity, or other legal entity
, any money or other thing of value ...” 18 U.S.C. 1030(a)(7)
(emphasis added)(the 2002 amendments struck out “firm, association, educational institution, financial institution,
government entity, or other legal entity”).
102 18 U.S.C. 1030(e)(12); Paradigm Alliance, Inc. v. Celeritas Technologies, LLC, 659 F.Supp.2d 1167, 1192 n.80 (D.
Kan. 2009).
103 18 U.S.C. 1030(e)(11); Paradigm Alliance, Inc. v. Celeritas Technologies, LLC, 659 F.Supp.2d 1167, 1190 n.74 (D.
Kan. 2009).
104 18 U.S.C. 1030(g).
105 Id.; A.V. ex rel. Vanderhyde v. iParadigms, 562 F.3d 630, 646 (4th Cir. 2009)(“iParadigms counters that ‘economic
damages’ ought be accorded its ordinary meaning, which would include consequential damages but exclude recovery
for pain and suffering or emotional distress... [The definition of ‘loss’] plainly contemplates consequential damages of
the type sought by iParadigms-cost incurred as part of the response to a CFAA violation, including investigation of an
offense”).
106 18 U.S.C. 1030(c)(2).
107 Pinkerton v. United States, 328 U.S. 640, 645-48 (1946); United States v. Parkes, 497 F.3d 220, 232 (2d Cir.
2007)(Under Pinkerton v. United States, “a defendant who does not directly commit a substantive offense may
(continued...)
Congressional Research Service
23

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Other Crimes
Paragraph 1030(a)(2) is somewhat unique. There are a host of other federal conversion statutes,
but all of the others appear to require that the offender either commit embezzlement by failing to
comply with some fiduciary obligation or commit larceny by intending to acquire the property or
to deprive another of it. Paragraph 1030(a)(2) in contrast to the conversion statutes and to the
computer fraud provisions of paragraph 1030(a)(4) requires no larcenous intent.108 As a practical
matter, it essentially gives prosecutors a more serious charge against hackers, who do more than
simply breach the outskirts of a governmental system, than would be available under the pure
trespassing provisions of paragraph 1030(a)(3). And it gives them an alternative or additional
charge, along with conversion and fraud statutes, against hackers who “steal” information from a
protected computer.109 It affords victims similar latitude in civil litigation under subsection
1030(g).
Paragraph 1030(a)(2) is essentially paragraph 1030(a)(3) plus an information acquisition element
and a broader jurisdictional base. Criminal prohibitions like those of 18 U.S.C. 1001 (false
statements on a matter with the jurisdiction of a federal agency) or 912 (impersonating a federal
official) which overlap with paragraph 1030(a)(3) at the point of unauthorized entry will overlap
with paragraph 1030(a)(2) at the same point. If unauthorized access in violation of paragraph
1030(a)(3) is acquired by false statement under facts sufficient supporting a prosecution under 18
U.S.C. 1001 (false statements) or 18 U.S.C. 912 (false impersonation), unauthorized access and
the acquisition of information in violation of paragraph 1030(a)(2) acquired by false statement or
impersonation is likely to subject an offender to prosecution under Sections 1001 or 912 as well.
By the same token, if unauthorized computer access to a voice mail or e-mail communication that
violates paragraph 1030(a)(3) offends 18 U.S.C. 2511 (interception of wire or electronic
communications) and 2701 (unauthorized acquisition of communications in electronic storage),
unauthorized computer access and acquisition of information in violation of paragraph 1030(a)(2)
is likely to violate Sections 2511 and 2701.110
In fact, overlap is even more likely than in the case of paragraph 1030(a)(3). Paragraph
1030(a)(3) protects only federal computers. Paragraph 1030(a)(2) protects not only federal
computer information, but information from “protected computers” (computers used in or
affecting interstate and foreign commerce). Due to the nature of Internet communications, a
communication may involve interstate communications even if both the parties are located within

(...continued)
nevertheless be liable if the commission of the offense by a co-conspirator in furtherance of the conspiracy was
reasonably foreseeable to the defendant as a consequence of their criminal agreement”); United States v. Moran, 493
F.3d 1002, 1009-110 (9th Cir. 2007); United States v. Roberson, 474 F.3d 432, 433 (7th Cir. 2007).
108 United States v. Willis, 476 F.3d 1121, 1125 (10th Cir. 2007).
109 See, United States v. Jordan, 316 F.3d 1215, 1223-224 (11th Cir. 2003)(noting the indictment of a sheriff, for
improper use of access to the FBI’s NCIC database, under paragraph 1030(a)(2), 18 U.S.C. 2 (aiding and abetting), 371
(conspiracy), and 641 (theft of federal property); the overlap between §1030 and federal laws that prohibit the theft of
intangible property under various circumstances is discussed at greater length in the examination of paragraph
1030(a)(4)(fraud), infra.
110 See, Konop v. Hawaiian Airlines, Inc., 302 F.3d 868, 875-80 (9th Cir. 2002)(discussing the application of 18 U.S.C.
2511 and 2701 to a case of unauthorized access to a secure website). See also, Motorola Credit Corp. v. Uzan, 388 F.3d
39, 44 (2d Cir. 2004) (discussing civil suit claiming violations of sections 1030, 2511, and 2701); Penrose Computer
Marketgroup, Inc. v. Camin
, 682 F.Supp.2d 202, 207-12 (N.D.N.Y. 2010); Global Policy Partners, LLC v. Yessin, 686
F.Supp.2d 631, 635-37 (E.D.Va. 2009).
Congressional Research Service
24

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

the same state.111 Moreover, a computer need only have a slight impact on commerce to satisfy
the “affect on interstate or foreign commerce” element.112 By virtue of an amendment in the USA
PATRIOT Act, protected computer information may include information on computers located
overseas as long as they involve or affect the foreign commerce or communications of the
United States.113
Interstate or Foreign Transportation of Stolen Property
Whether a hacker, who steals information stored in a computer, violates any of the general federal
theft statutes depends upon whether the particular statute covers intangible property, and if not,
whether the victim has been defrauded of tangible, in addition to intangible, property. For
instance, the Supreme Court has noted that 18 U.S.C. 2314, that outlaws the interstate
transportation of stolen goods, wares, or merchandise,114 “contemplate[s] a physical identity
between the items unlawfully obtained and those eventually transported.”115 Thus, the theft of
information stored in a computer may be prosecuted under Section 2314 only if the government
can establish that it was accomplished in conjunction with the theft and transportation of a
physical item. Downloading information onto a stolen computer disk and then transporting the

111 United States v. Kammersell, 196 F.3d 1137, 1138-140 (10th Cir. 1999)(a threat communicated between two
computers in Utah involved interstate communications because the communication was forwarded by way of AOL’s
server in Virginia); United States v. Trotter, 478 F.3d 918, 921, 922 (8th Cir. 2007)(“As both the means to engage in
commerce and the method by which transactions occur, the Internet is an instrumentality and channel of interstate
commerce ... [O]nce the computer is used in interstate commerce, Congress has the power to protect it”); United States
v. Sutcliffe
, 505 F.3d 944, 953 (9th Cir. 2007); United States v. Mitra, 405 F.3d 492, 496 (7th Cir. 2005).
112 Cf., United States v. Kincaid-Chauncey, 556 F.3d 923, 936 (9th Cir. 2009); United States v. Mejia, 545 F.3d 179,
203 (2d Cir. 2008); United States v. DeCologero, 53 F.3d 36, 37-8 (1st Cir. 2008).
113 “[T]he term ‘protected computer’ means a computer – (A) exclusively for the use of a financial institution or the
United States Government, or, in the case of a computer not exclusively for such use, used by or for a financial
institution or the United States Government and the conduct constituting the offense affects that use by or for the
financial institution or the Government; or (B) which is used in interstate or foreign commerce or communication,
including a computer located outside the United States that is used in a manner that affects interstate or foreign
commerce or communication of the United States
,” 18 U.S.C. 1030(e)(2)(language added in the USA PATRIOT Act in
italics).
114 “Whoever transports, transmits, or transfers in interstate or foreign commerce any goods, wares, merchandise,
securities or money, of the value of $5,000 or more, knowing the same to have been stolen, converted or taken by
fraud; or
“Whoever, having devised or intending to devise any scheme or artifice to defraud, or for obtaining money or
property by means of false or fraudulent pretenses, representations, or promises, transports or causes to be transported,
or induces any person or persons to travel in, or to be transported in interstate or foreign commerce in the execution or
concealment of a scheme or artifice to defraud that person or those persons of money or property having a value of
$5,000 or more; or
“Whoever, with unlawful or fraudulent intent, transports in interstate or foreign commerce any falsely made, forged,
altered, or counterfeited securities or tax stamps, knowing the same to have been falsely made, forged, altered, or
counterfeited; or
“Whoever, with unlawful or fraudulent intent, transports in interstate or foreign commerce any traveler’s check
bearing a forged countersignature; or
“Whoever, with unlawful or fraudulent intent, transports in interstate or foreign commerce, any tool, implement, or
thing used or fitted to be used in falsely making, forging, altering, or counterfeiting any security or tax stamps, or any
part thereof—
“Shall be fined under this title or imprisoned not more than ten years, or both....” 18 U.S.C. 2314.
115 Dowling v. United States, 473 U.S. 207, 216 (1985). Dowling involved the transportation of bootleg phonograph
records which were not themselves stolen.
Congressional Research Service
25

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

disk across a state line is covered, yet downloading information onto a computer disk that is
transported but not stolen is not covered; however, courts have begun to differ in this
interpretation and some have found an electronic file to be a tangible good within the meaning of
Section 2314.116
The federal statute proscribing theft from interstate carriers, 18 U.S.C. 659, speaks in terms of
stealing “goods and chattels” under a variety of circumstances.117 And it is presumably subject to
the same analysis: Section 659 applies only to the theft of physical items; even if all of the other
elements are satisfied, computer fraud is proscribed by Section 659 only where it involves the
theft of a physical item.
Theft of Federal Government Information
Prosecuting computer fraud under a statute that outlaws the interstate transportation of stolen
“goods, wares, merchandise, securities or money” may be an awkward fit. The general theft of
government property statute, 18 U.S.C. 641, seems a better match, however, for that provision
outlaws the misappropriation of any “thing of value” belonging to or in the possession of the

116 United States v. Aleynikov, 737 F.Supp.2d 173, 186-90 (S.D.N.Y. 2010) (computer source code constitutes “goods”
for purposes of 18 U.S.C. 2314); United States v. Brown, 925 F.2d 1301, 1305-309 (10th Cir. 1991); United States v.
Lyons
, 992 F.2d 1029, 1033 (10th Cir. 1993)(“In Brown, we applied the Supreme Court’s decision in Dowling v. United
States
, 474 U.S. 207 (1985) to computer software, and held that the intangible intellectual property of a computer
program standing alone cannot constitute goods, wares or merchandise within the meaning of 18 U.S.C. 2314. The fact
that Mr. Lyons stole the software in conjunction with the theft of tangible hardware distinguishes this case from Brown.
Brown
recognizes that the theft of intangible intellectual property in conjunction with the theft of tangible property falls
within the ambit of §2314. Unlike the present case, there was no evidence in Brown that [the] defendant was involved
in the physical theft or transportation of stolen tangible property”); United States v. Martin, 228 F.3d 1, 14 (1st Cir.
2000)(§2314 applies “when there has been some tangible item taken, however insignificant or valueless it may be,
absent the intangible component”). But see, United States v. Riggs, 739 F. Supp 414, 420 (N.D. Ill. 1990) which found
the electronic transfer of proprietary information to be covered by this statute (“If the information in [the plaintiff’s]
text file had been affixed to a floppy disk, or printed out on a computer printer, then [defendant’s] transfer of that
information across state lines would clearly constitute the transfer of goods, wares, or merchandise within the meaning
of §2314. This court sees no reason to hold differently simply because [defendant] stored the information inside
computers instead of printing it out on paper. In either case, the information is in a transferrable, accessible, even
salable form.”). See also United States v. Farraj, 142 F. Supp. 2d 484, 489-90 (S.D.N.Y. 2001)(the court disagreed
with Brown and the 10th Circuit line of cases, and instead determined “the view most closely analogous to Second
Circuit doctrine is that which holds that the transfer of electronic documents via the internet across state lines does fall
within the purview of §2314”).
If §2314 does apply to a given case, then §2315 that prohibits receipt of stolen property may also be implicated.
117 “Whoever embezzles, steals, or unlawfully takes, carries away, or conceals, or by fraud or deception obtains from
any pipeline system, railroad car ... with intent to convert to his own use any goods or chattels moving as or which are a
part of or which constitute an interstate or foreign shipment of freight, express, or other property; or
“Whoever buys or receives or has in his possession any such goods or chattels, knowing the same to have been
embezzled or stolen; or
“Whoever embezzles, steals, or unlawfully takes, carries away, or by fraud or deception obtains with intent to
convert to his own use any baggage which shall have come into the possession of any common carrier for
transportation in interstate or foreign commerce ... or
“Whoever embezzles, steals, or unlawfully takes by any fraudulent device, scheme, or game, from any railroad car,
bus, vehicle, steamboat, vessel, or aircraft operated by any common carrier moving in interstate or foreign commerce or
from any passenger thereon any money, baggage, goods, or chattels....
“Shall in each case be fined under this title or imprisoned not more than ten years, or both; but if the amount or
value of such money, baggage, goods or chattels does not exceed $1,000, he shall be fined under this title or imprisoned
not more than one year, or both....” 18 U.S.C. 659.
Congressional Research Service
26

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

federal government.118 The courts have applied §641 to the misappropriation of property that
lacks any necessary corporal features.119
Economic Espionage
Paragraph 1030(a)(2) overlaps with the Economic Espionage Act when the information acquired
through unauthorized access is a trade secret.120 The Economic Espionage Act, among other
things, outlaws computerized burglary committed in a commercial setting, 18 U.S.C. 1832.121 It
makes it a federal crime to steal certain trade secrets, or to receive such trade secrets with the

118 “Whoever embezzles, steals, purloins, or knowingly converts to his use or the use of another, or without authority,
sells, conveys or disposes of any record, voucher, money, or thing of value of the United States or of any department or
agency thereof, or any property made or being made under contract for the United States or any department or agency
thereof; or
“Whoever receives, conceals, or retains the same with intent to convert it to his use or gain, knowing it to have been
embezzled, stolen, purloined or converted B
“Shall be fined under this title or imprisoned not more than ten years, or both; but if the value of such property in the
aggregate, combining amounts from all the counts for which the defendant is convicted in a single case, does not
exceed the sum of $1,000, he shall be fined under this title or imprisoned not more than one year, or both.”
“The word ‘value’ means face, par, or market value, or cost price, either wholesale or retail, whichever is greater,”
18 U.S.C. 641.
119 See e.g., United States v. Jordan, 582 F.3d 1239, 1242(11th Cir. 2009)(affirming the conviction under 18 U.S.C. 641
for theft of government property in the form of impermissible access and use of information contained in a federal data
base (NCIC files)); United States v. Forman, 180 F.3d 766, 767-68 (6th Cir. 1999)(information from a confidential
government report concerning a criminal investigation); United States v. Collins, 56 F.3d 1416, 1419-420 (D.C.Cir.
1995)(computer time and storage); United States v. Martzkin, 14 F.3d 1014, 1018-21 (4th Cir. 1994)(bids on
government contracts); United States v. Jeter, 775 F.2d 670, 680 (6th Cir. 1985)(information as to matters occurring
before a federal grand jury); United States v. Girard, 601 F.2d 69, 70-1 (2d Cir. 1979) (identity of government
undercover agents); United States v. Lambert, 446 F.Supp. 890, 892-95 (D.Conn. 1978)(information stolen from a DEA
computer data base).
120 E.g., United States v. Genovese, 409 F.Supp.2d 253 (S.D.N.Y. 2005)(refusing to dismiss on the bases of overbreadth
and vagueness grounds an indictment under §1832 for downloading Microsoft source code without authorization).
121 “(a) Whoever, with intent to convert a trade secret,*, that is related to or included in a product that is produced for or
placed in interstate or foreign commerce, to the economic benefit of anyone other than the owner thereof, and intending
or knowing that the offense will, injure any owner of that trade secret, knowingly – (1) steals, or without authorization
appropriates, takes, carries away, or conceals, or by fraud, artifice, or deception obtains such information; (2) without
authorization copies, duplicates, sketches, draws photographs, downloads, uploads, alters, destroys, photocopies,
replicates, transmits, delivers, sends, mails, communicates, or conveys such information; (3) receives, buys, or
possesses such information, knowing the same to have been stolen or appropriated, obtained, or converted without
authorization; (4) attempts to commit any offense described in paragraphs (1) through (3); or (5) conspires with one or
more other persons to commit any offense described in paragraphs (1) through (3), and one or more of such persons do
any act to effect the object of the conspiracy, – shall, except as provided in subsection (b), be fined under this title or
imprisoned not more than 10 years, or both.
“(b) Any organization that commits any offense described in subsection (a) shall be fined not more than
$5,000,000,” 18 U.S.C. 1832.
* “‘[T]rade secret’ means all forms and types of financial, business, scientific, technical, economic, or engineering
information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods,
techniques, processes, procedures, programs, or codes, whether tangible or intangible, and whether or how stored,
compiled, or memorialized physically, electronically, graphically, photographically, or in writing if—(A) the owner
thereof has taken reasonable measures to keep such information secret; and (B) the information derives independent
economic value, actual or potential, from not being generally known to, and not being readily ascertainable through
proper means by, the public,” 18 U.S.C. 1839(3); see generally, Twenty-Sixth Survey of White Collar Crime,
Intellectual Property Crimes
, 48 AMERICAN CRIMINAL LAW REVIEW 849 (2011); Pooley, Lemley & Toren,
Understanding the Economic Espionage Act of 1996, 5 TEXAS INTELLECTUAL PROPERTY LAW JOURNAL 177 (1997).
Congressional Research Service
27

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

knowledge they have been stolen, or to conspire or attempt to steal them, or to conspire or
attempt to receive them knowing they have been stolen. To be covered by the protective umbrella
of the section, information must (1) have a nexus interstate or foreign commerce; (2) be a secret;
and (3) have some trade value.
Information meets the commerce nexus when it is associated with a product that is marketed
across state lines, that is, if it is “related to or included in a product that is produced for or placed
in interstate or foreign commerce.”122 Information is considered “secret” if it is “not generally
known to the public or to the business, scientific, or education community in which [its] owner
might seek to use the information” and its owner takes reasonable steps to maintain its
confidentiality.123
But what makes the economic espionage section a particularly effective shield against
computerized burglary in a commercial setting is that the trade secret information it protects
includes “all forms and types of financial, business, scientific, technical, economic, or
engineering information, including patterns, plans, compilations, program devices, formulas,
designs, prototypes, methods, techniques, processes, procedures, programs, or codes, whether
tangible or intangible, and whether or how stored, compiled, or memorialized physically,
electronically, graphically, photographically, or in writing.”124
Violations of the economic espionage provisions are punishable by imprisonment for not more
than 10 years and/or a fine of not more than the greater of twice the amount of pecuniary gain or
loss resulting from the offense or $250,000 (not more than $5 million if the offender is an
organization).125
Copyright infringement
Downloading information after unauthorized access to a protected computer may violate not only
paragraph 1030(a)(2) but may constitute copyright infringement as well. Computer software
programs are ordinarily protected by copyright which generally precludes copying of protected
material without the consent of the holder of the copyright. Copyright law outlaws three forms of
willful copyright infringement: (A) infringement for “commercial advantage or private financial
gain;”126 (B) infringement by reproduction of distribution of protected works worth more than
$1,000;127 and (C) infringement by “distribution of a work being prepared for commercial
distribution, by making it available on a computer network accessible to members of the public, if
such person knew or should have known that the work was intended for commercial
distribution.”128
Each of the three forms of infringement has its own penalty structure under 18 U.S.C. 2319.
Infringement for profit or commercial advantage is punishable by prison terms with maximum

122 18 U.S.C. 1832(a).
123 H.Rept. 788 at 12; 18 U.S.C. 1839(3).
124 18 U.S.C. 1839(3).
125 18 U.S.C. 1832, 3571.
126 17 U.S.C. 506(a)(1)(A).
127 17 U.S.C. 506(a)(1)(B).
128 17 U.S.C. 506(a)(1)(C).
Congressional Research Service
28

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

limits of 1 to 10 years depending on the extent of the violation.129 The maximum term of
imprisonment for infringement on works worth more than $1,000 ranges from 1 to 6 years.130
Finally, the infringement involving works in preparation for distribution carries maximum
penalties ranging from 3 to 10 years.131 The offenses are also subject to fines of not more than
$250,000 (not more than $500,000 for organizations) if the maximum term of imprisonment is
more than 1 year, and otherwise of not more than $100,000 (not more than $200,000 for
organizations).132
Money Laundering
The principal federal money laundering statutes, 18 U.S.C. 1956 and 1957, outlaw various
financial activities that involve the proceeds from other federal crimes.133 They prohibit
• domestic laundering of the proceeds of these predicate offenses, referred to as
“specified unlawful activities;”
• international laundering of the proceeds of predicate offenses;
• using the proceeds of predicate offenses to promote further predicate offenses;134
or
• spending or depositing more than $10,000 of the proceeds of predicate
offenses.135
Offenses under the various paragraphs of 18 U.S.C. 1030 are all money laundering predicate
offenses,136 although paragraph 1030(a)(2) information acquisition offenses are less likely to

129 18 U.S.C. 2319(b)(“(b) Any person who commits an offense under section 506(a)(1)(A) of title 17B (1) shall be
imprisoned not more than 5 years, or fined in the amount set forth in this title, or both, if the offense consists of the
reproduction or distribution, including by electronic means, during any 180-day period, of at least 10 copies or
phonorecords, of 1 or more copyrighted works, which have a total retail value of more than $2,500; (2) shall be
imprisoned not more than 10 years, or fined in the amount set forth in this title, or both, if the offense is a second or
subsequent offense under paragraph (1); and (3) shall be imprisoned not more than 1 year, or fined in the amount set
forth in this title, or both, in any other case”).
130 18 U.S.C. 2319(c)(“Any person who commits an offense under section 506(a)(1)(B) of title 17B (1) shall be
imprisoned not more than 3 years, or fined in the amount set forth in this title, or both, if the offense consists of the
reproduction or distribution of 10 or more copies or phonorecords of 1 or more copyrighted works, which have a total
retail value of $2,500 or more; (2) shall be imprisoned not more than 6 years, or fined in the amount set forth in this
title, or both, if the offense is a second or subsequent offense under paragraph (1); and (3) shall be imprisoned not more
than 1 year, or fined in the amount set forth in this title, or both, if the offense consists of the reproduction or
distribution of 1 or more copies or phonorecords of 1 or more copyrighted works, which have a total retail value of
more than $1,000”).
131 18 U.S.C. 2319(d)(“(d) Any person who commits an offense under section 506(a)(1)(C) of title 17B (1) shall be
imprisoned not more than 3 years, fined under this title, or both; (2) shall be imprisoned not more than 5 years, fined
under this title, or both, if the offense was committed for purposes of commercial advantage or private financial gain;
(3) shall be imprisoned not more than 6 years, fined under this title, or both, if the offense is a second or subsequent
offense; and (4) shall be imprisoned not more than 10 years, fined under this title, or both, if the offense is a second or
subsequent offense under paragraph (2)”).
132 18 U.S.C. 3571.
133 See generally, Twenty-Sixth Survey of White Collar Crime: Money Laundering, 48 AMERICAN CRIMINAL LAW
REVIEW 929 (2011); CRS Report RL33315, Money Laundering: An Overview of 18 U.S.C. 1956 and Related Federal
Criminal Law
.
134 18 U.S.C. 1956 (text appended).
135 18 U.S.C. 1957.
Congressional Research Service
29

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

generate proceeds than are the fraud and espionage offenses of paragraphs 1030(a)(4) and
1030(a)(1).
Causing Computer Damage (18 U.S.C. 1030(a)(5))
Whoever ... (5)(A) knowingly causes the transmission of a program, information, code, or
command, and as a result of such conduct, intentionally causes damage137 without
authorization, to a protected computer;138
(B) intentionally accesses a protected computer without authorization, and as a result of
such conduct, recklessly causes damage; or
(C) intentionally accesses a protected computer without authorization, and as a result of
such conduct, causes damage and loss.
(b) Whoever attempts to commit an offense under subsection (a) of this section shall be
punished as provided in subsection (c) of this section.

Intent
Paragraph 1030(a)(5) establishes crimes of dual intent B the intent to knowingly or intentionally
intrude and the intent to damage. Paragraph 1030(a)(5) establishes three computer damage
offenses, distinguishable on the basis of the offender’s intent to intrude and cause damage: (A)
intentionally causing damage without authorization to a protected computer through a knowing
transmission; (B) recklessly causing damage to a protected computer by intentional unauthorized
access; and (C) causing damage and loss to a protected computer by intentional unauthorized
access. This feature, added in 1996 and amended in the USA PATRIOT and Homeland Security
Acts, preserves the earlier understanding that anyone who intentionally secures unauthorized
access is punishable for any resulting damage regardless of whether he intended to cause it, or
were recklessly indifferent as to whether he did so.139

(...continued)
136 18 U.S.C. 1956(c)(7)(D), 1957(f)(3).
137 “The term ‘damage’ means any impairment to the integrity or availability of data, a program, a system, or
information ... the term ‘loss’ means an reasonable cost to any victim, including the cost of responding to an offense,
conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the
offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of
service,” 18 U.S.C. 1030(e)(8), (11).
138 “As used in this section ... (2) the term ‘protected computer’ means a computer—(A) exclusively for the use of a
financial institution or the United States Government, or, in the case of a computer not exclusively for such use, used
by or for a financial institution or the United States Government and the conduct constituting the offense affects that
use by or for the financial institution or the Government; or (B) which is used in or affecting interstate or foreign
commerce or communication including a computer located outside the United States that is used in a manner that
affects interstate or foreign commerce or communication of the United States,” 18 U.S.C. 1030(e)(2). The Identity
Theft Enforcement and Restitution Act added the phrase “or affecting” to the definition, §207, P.L. 110-326, 122 Stat.
3563 (2008).
139 Even under an earlier version of the paragraph 1030(a)(5) that outlawed “intentional access ... without authorization,
and by means of ... such conduct ... prevent[ing] authorized use of any such computer ... and thereby causes loss to one
or more others of a value aggregating $1,000 or more ...,” the government was not required to show that the defendant
intentionally prevented use nor that he intentionally caused damage “aggregating $1,000 or more”; a demonstration that
he intentionally accessed a protected computer without authorization was sufficient, United States v. Morris, 928 F.2d
504 (2d Cir. 1991)(Morris, a computer graduate student, was convicted under 18 U.S.C. 1030(a)(5) for releasing a
“worm” on the Internet that “spread and multiplied, eventually causing computers at various educational institution and
military sites to crash or cease functioning,” 928 F.2d at 505); United States v. Sablan, 92 F.3d 865, 868 (9th Cir. 1996).
Sablan, a disgruntled former bank employee, surreptitiously entered the bank after hours and “called up” and damaged
(continued...)
Congressional Research Service
30

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

When subparagraph 1030(a)(5)(A) proscribes knowing transmission rather than the intentional
access proscribed in subparagraphs 1030(a)(5)(B) and (C), it reaches the both the direct and
indirect infliction of damage.140 To establish the transmission element of the intentional damage
offense in subparagraph 1030(a)(5)(A), “the government must offer sufficient proof that the
person charged is the same person who sent the transmission. Circumstantial evidence is
sufficient to prove that the transmission occurred.”141 Moreover, transmission includes
installation of a destructive program.142 Transmission need only be done knowingly, but the
damage must be done intentionally. That is, the defendant must be shown to have to caused the
transmission “with the conscious purpose of causing damage.” 143
Where the other paragraphs of 18 U.S.C. 1030 speak of unauthorized access, they mention
“exceeding authorized access” as an alternative.144 Subparagraph 1030(a)(5)(B) and (C) reckless
and simple provisions do not; they speak only of unauthorized access. The difference has been
construed to mean that only outsiders may violate the reckless and simple damage clauses.145
Damage
Damage is the element common to any of paragraph 1030(a)(5)’s offenses. The Identity Theft
Enforcement and Restitution Act rewrote the damage offenses of paragraph 1030(a)(5). Prior to
amendment, the paragraph only reached cases involving serious damage,146 which it punished as
felonies when the harm was intentionally or recklessly caused and as a misdemeanor in simple
damage cases.147 Intentionally or recklessly causing serious computer damage is still covered and
treated as a felony, but now intentionally or recklessly causing less serious computer damage is
also covered and treated as a misdemeanor.148 Simple damage is still treated as a misdemeanor,

(...continued)
several files from the bank’s mainframe on the computer to which she had been assigned prior to her discharge.
140 DoJ Computer Crimes, at 32 (“Section 1030(a)(5)(A)[] requires proof only of the knowing transmission of
something to damage a computer without authorization. The government does not need to prove ‘access.’ Because it is
possible to damage a computer without ‘accessing’ it, this element is easier to prove (except for the mental state
requirement). For example, most worms and trojans spread through self-replication, without personally accessing the
affecting systems”).
141 United States v. Shea, 493 F.3d 1110, 1115 (9th Cir. 2007).
142 Patrick Patterson Custom Homes, Inc. v. Bach, 586 F.Supp.2d 1026, 1034-35 (N.D. Ill. 2008), citing, International
Airport Centers v. Citrin
, 440 F.3d 418, 419-20 (7th Cir. 2006).
143 Pulte Homes, Inc. v. Laborers’’ International Union, 648 F.3d 295, 302-303 (6th Cir. 2011).
144 E.g., 18 U.S.C. 1030(a)(4)(emphasis added)(“Whoever ...(4) knowingly and with intent to defraud, accesses a
protected computer without authorization, or exceeds authorized access ...”)
145 S.Rept. 104-357, at 11 (1996)(“In sum under the bill, insiders, who are authorized to access a computer, face
criminal liability only if they intend to cause damage to a computer, not for recklessly or negligently causing damage.
By contrast, outside hackers who break into a computer could be punished for any intentional, reckless, or other
damage they cause by their trespass”), quoted in, United States v. Phillips, 477 F.3d 215, 219 (5th Cir. 2007); DoJ
Computer Crimes
, at 33 (“Subsections 1030(a)(5)(A)(ii) and (iii) require proof that the defendant intentionally accessed
a protected computer without authorization. These subsections do not include the phrase ‘exceeds authorized access.’
Thus, these subsections do not apply to authorized users of a computer who exceed their authorization (insiders)”).
146 That is, damage that either caused a loss over the course of a year exceeding $5,000; or “modifie[d], impair[ed], or
could modify or impair medical services; cause[d] physical injury; threaten[ed] public health or safety; or affect[ed] a
justice, national defense, or national security entity computer,” 18 U.S.C. 1030(a)(5)(B)(2006 ed.).
147 18 U.S.C. 1030(a)(5), (c) (2006 ed.).
148 18 U.S.C. 1030(a)(5)(A), (B), (C).
Congressional Research Service
31

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

but unlike its companions for which proof of damage alone is sufficient the subparagraph
1030(a)(5)(C) simple damage offense requires proof of both damage and loss.
Damage is defined as “any impairment to the integrity or availability of data, a program, a
system, or information.”149 Qualifying damage thus encompasses not only destruction but
diminished availability.150 Loss is described as “any reasonable cost to any victim, including the
cost of responding to an offense, conducting a damage assessment, and restoring the data,
program, system, or information to its condition prior to the offense, and any revenue lost, cost
incurred, or other consequential damages incurred because of interruption of service.”151
Without Authorization
The crimes of paragraph 1030(a)(5) have no “exceeds authorization” element. Instead, they
condemn transmission that causes unauthorized damage; unauthorized access that recklessly
causes damage; and unauthorized access that causes damage and loss.152 A defendant who has
been granted access cannot be said to have gained unauthorized access though his use may have
exceeded the purposes for which authorization granted.153
Jurisdiction
Computer damage is only a federal crime under paragraph 1030(a)(5), however, if it involves a
“protected computer.” Five types of computers or computer systems are “protected.” The five
include those
• used exclusively for or by the United States government;
• used exclusively for or by a bank or other financial institution;
• used in part for or by the United States government where the damage “affects”
the government use or use on the government’s behalf;

149 18 U.S.C. 1030(e)(8); Czech v. Wall Street on Demand, Inc., 674 F.Supp.2d 1102, 1107 (D. Minn. 2009).
150 Pulte Homes, Inc. v. Laborers’ International Union, 648 F.3d 295, 301-302 (6th Cir. 2011)(internal citations and
some quotation marks omitted)(“Because the statute includes no definition of three key terms – ‘impairment,’
‘integrity,’ and ‘availability’ – we look to the ordinary meanings of these words. ‘Impairment’ means a ‘deterioration’
or an ‘injurious lessening or weakening.’ The definition of ‘integrity’ includes an ‘uncorrupted condition,’ an ‘original
perfect state,’ and ‘soundness. And ‘availability’ is the ‘capability of being employed or made use of.’ Applying these
ordinary usages, we conclude that a transmission that weakens a sound computer system – or, similarly, one that
diminishes a plaintiff’s ability to use date or a system – causes damage . . . . Moreover, our interpretation comports with
two decisions from sister circuits. The Third Circuit sustained a transmission conviction where the defendant ‘admitted
that in using the direct e-mailing method and sending thousands of e-mails to one inbox, the targeted inbox would flood
with e-mails and thus impair the user’s ability to access his other good e-mails.’ . . . And the Seventh Circuit upheld the
defendant’s transmission conviction because he impaired the availability of an emergency communication system when
‘[d]ata that [he] sent interfered with the way the computer allocated communications to the other 19 [radio] channels
and stopped the flow of information among public safety officers’”).
151 18 U.S.C. 1030(e)(11); A.V. ex rel. Vanderhye, 562 F.3d 630, 645-46 (4th Cir. 2008); In re Apple & At & TM
Antitrust Litigation
, 596 F.Supp.2d 1288, 1308 (N.D. Cal. 2008).
152 18 U.S.C. 1030(a)(5)(A), (B), and (C), respectively.
153 Pulte Homes, Inc. v. Laborers’ International Union, 648 F.3d 295, 303-304 (6th Cir. 2011).
Congressional Research Service
32

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

• used in part for or by a bank or other financial institution where the damage
“affects” use by or on behalf of the institution; and
• used in or affecting interstate or foreign commerce or communications including
a computer outside the country whose use affects U.S. commerce.154
What is a “computer ... used in interstate or foreign commerce or communications”? The
legislative history shows that the phrase means computer damage which might affect interstate or
foreign commerce or interstate or foreign communications. The phrase appears in Section 1030
after the 1994 amendments when it was first used to supplement (and in the 1996 amendments to
replace) the phrase “computer ... which is one of two or more computers used in committing the
offense, not all of which are located in the same State.”155 The change was made because under
the earlier language “hackers who attacked other computers in their own State were not subject to
Federal jurisdiction, notwithstanding the fact that their actions may have severely affected
interstate or foreign commerce. For example, individuals who attack[ed] telephone switches
m[ight] disrupt interstate and foreign calls. The 1994 change remedied that defect.”156 The
inherently interstate nature of the Internet is such that a computer used to access the Internet is a
computer used in interstate or foreign commerce, and consequently a computer whose protection
is within Congress’s power to regulate.157
A computer “affecting interstate or foreign commerce” need apparently have no Internet
connection nor be part of any interstate communications network. If the phrase is given its
ordinary meaning, no more is required than that the computer or computer system have some
slight impact on interstate or foreign commerce.158 This seems to have been the intent of its
sponsors.159
Precisely which government computers are protected is a bit more uncertain. Although terms used
elsewhere in Section 1030 such as “governmental entity” and “department of the United States”
are expressly defined,160 there is no definition of either the phrase “United States Government” or
the phrase “Government of the United States” used from the beginning to describe the scope of
protection provided federal computers. The reports do not explain its meaning. In the trespassing
provisions of paragraph 1030(a)(3), however, the phrase is used in juxtaposition with the phrase
“department or agency of the United States”161 suggesting that the term embodies the meaning

154 18 U.S.C. 1030(e)(2). §207 of the Identity Theft Enforcement and Restitution Act added the phrase “or affecting” to
the definition of protected computers, §207, 122 Stat. 3563 (2008).
155 Compare 18 U.S.C. 1030(a)(5), (e)(2)(1986 Supp.), with 18 U.S.C. 1030(a)(5), (e)(2)(1994 ed.).
156 S.Rept. 104-357 at 10 (1996).
157 United States v. Trotter, 478 F.3d 918, 921, 922 (8th Cir. 2007); United States v. Sutcliffe, 505 F.3d 944, 953 (9th Cir.
2007); United States v. Mitra, 405 F.3d 492, 496 (7th Cir. 2005).
158 The courts have generally held that only a slight impact on commerce is necessary to satisfy an offense’s “affect on
interstate or foreign commerce” element, United States v. Kincaid-Chauncey, 556 F.3d 923, 936 (9th Cir. 2009); United
States v. Mejia
, 545 F.3d 179, 203 (2d Cir. 2008); United States v. DeCologero, 53 F.3d 36, 37-8 (1st Cir. 2008).
159 153 Cong. Rec. S14570 (daily ed. November 15, 2007)(remarks of Sen. Leahy).
160 “As used in this section ... (7) the term ‘department of the United States’ means the legislative or judicial branch of
the Government or one of the executive departments enumerated in §101 of title 5 ... (9) the term ‘government entity’
includes the Government of the United States, any State or political subdivision of the United States, any foreign
country, and any state, province, municipality, or other political subdivision of a foreign country,” 18 U.S.C.
1030(e)(9).
161 “Whoever ... intentionally, without authorization to access any nonpublic computer of a department or agency of the
United States
, accesses such a computer of that department or agency that is exclusively for the use of the Government
(continued...)
Congressional Research Service
33

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

assigned to that phrase by the definition subsection of Section 1030162 and by the definition
section generally applicable to Title 18 of the United States Code.163 On the other hand, it would
not be unreasonable for a court to conclude that the phrases “United States Government” and
“Government of the United States” should be construed narrowly since when Congress intended
an expansive definition it provided one. The definition of financial institutions whose computers
are protected164 differs only slightly from the definition generally applicable in Title 18.165
The question persists as to whether by specifically mentioning overseas computers in the
interstate and foreign commerce basis for jurisdiction (“including a computer outside the country
whose use affects U.S. commerce”), Congress intended to preclude overseas application of the
other bases for jurisdiction (e.g., damage to government computers).
Consequences
Penalties
The paragraph punishes causing serious damage recklessly or intentionally inflicted more
severely than causing damage without necessarily intending to do so or than causing less serious
damage intentionally or recklessly. It also punishes repeat offenders more severely. Thus, the
punishment for a violation of subparagraph 1030(a)(5)(A)(knowingly causing a transmission that
intentionally causes damage) is

(...continued)
of the United States or, in the case of a computer not exclusively for such use, is used by or for the Government of the
United States and such conduct affects that use by or for the Government of the United States....” 18 U.S.C.
1030(a)(3)(emphasis added).
162 18 U.S.C. 1030(e)(7).
163 “As used in this title: The term ‘department’ means one of the executive departments enumerated in Section 1 [now
Section 1010] of Title 5, unless the context shows that such term was intended to describe the executive, legislative, or
judicial branches of the government. The term ‘agency’ includes any department, independent establishment,
commission, administration, authority, board or bureau of the United States or any corporation in which the United
States has a proprietary interest, unless the context shows that such term was intended to be used in a more limited
sense,” 18 U.S.C. 6.
164 “(e) As used in this section ... (4) the term ‘financial institution’ means—(A) an institution with deposits insured by
the Federal Deposit Insurance Corporation; (B) the Federal Reserve or a member of the Federal Reserve including any
Federal Reserve Bank; (C) a credit union with accounts insured by the National Credit Union Administration; (D) a
member of the Federal home loan bank system and any home loan bank; (E) any institution of the Farm Credit System
under the Farm Credit Act of 1971; (F) a broker-dealer registered with the Securities and Exchange Commission
pursuant to Section 15 of the Securities Exchange Act of 1934; (G) the Securities Investor Protection Corporation; (H)
a branch or agency of a foreign bank (as such terms are defined in paragraphs (1) and (3) of Section 1(b) of the
International Banking Act of 1978); (I) an organization operating under section 25 or section 25(a) of the Federal
Reserve Act,” 18 U.S.C. 1030(e)(4).
165 “As used in this title, the term ‘financial institution’ means—(1) an insured depository institution (as defined in
section 3(c)(2) of the Federal Deposit Insurance Act); (2) a credit union with accounts insured by the National Credit
Union Share Insurance Fund; (3) a Federal home loan bank or a member, as defined in section 2 of the Federal Home
Loan Bank Act (12 U.S.C. 1422), of the Federal home loan bank system; (4) a System institution of the Farm Credit
System, as defined in section 5.35(3) of the Farm Credit Act of 1971; (5) a small business investment company, as
defined in Section 103 of the Small Business Investment Act of 1958 (15 U.S.C. 662); (6) a depository institution
holding company (as defined in section 3(w)(1) of the Federal Deposit Insurance Act; (7) a Federal Reserve bank or a
member bank of the Federal Reserve System; (8) an organization operating under section 25 or section 25(a) of the
Federal Reserve Act; or (9) a branch or agency of a foreign bank (as such terms are defined in paragraphs (1) and (3) of
Section 1(b) of the International Banking Act of 1978),” 18 U.S.C. 20.
Congressional Research Service
34

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

- imprisonment for any term of years or for life and/or a fine of not more than $250,000 (not
more than $500,000 for an organization), if the defendant knowingly or recklessly causes a
death through the commission of the offense;166
- imprisonment for not more than 20 years and/or a fine of not more than $250,000 (not more
than $500,000 for an organization), if the defendant knowingly or recklessly causes serious
bodily injury through the commission of the offense;167
- imprisonment for not more than 20 years and/or a fine of not more than $250,000 (not more
than $500,000 for an organization), if the defendant a prior conviction under subsections
1030(a) or (b);168
- imprisonment for not more than 10 years and/or a fine of not more than $250,000 (not more
than $500,000 for an organization), if the offense
• causes a loss that over the course of a year exceeds $5,000;169
• modifies, impairs, or could modify or impair medical services;
• causes physical injury;
• threatens public health or safety;
• affects a justice, national defense, or national security entity computer; or
• affects 10 or more protected computers over the course of a year.170
- imprisonment for not more than for not more than 1 year and/or a fine of not more than
$100,000 (not more than $200,000 for an organization), for any other violation of the
subparagraph.171
The punishment for a violation of subparagraph 1030(a)(5)(B)(intentional access that reckless
causes damage) is
- imprisonment for not more than 20 years and/or a fine of not more than $250,000 (not more
than $500,000 for an organization), if the defendant a prior conviction under subsections
1030(a) or (b);172

166 18 U.S.C. 1030(c)(4)(F), 3571. In case of the each the paragraph 1030(a)(5) offenses, the punishment for attempt to
commit the offense is the same as for the substantive offense, 18 U.S.C. 1030(c)(4), and perhaps the same can be said
of conspiracy, 18 U.S.C. 1030(b).
167 18 U.S.C. 1030(c)(4)(E), 3571. §1030 does not define the term “serious bodily injury.” The term is defined
throughout the federal criminal code as “bodily injury which involves - (A) a substantial risk of death; (B) extreme
physical pain; (C) protracted and obvious disfigurement; or (D) protracted loss or impairment of the function of a
bodily member, organ, or mental faculty,” 18 U.S.C. 1365(h)(3); 43(d)(3), 113(b)(2), 1153(a), 1992(d)(12), 2119(2),
2266(2), 2332b(g)(3), 2332f(e)(1), 2339C(d)(11), 2441(d)(2)(B).
168 18 U.S.C. 1030(c)(4)(C), 3571.
169 More precisely, “(A)(i) ... if the offense caused (or, in the case of an attempted offense, would, if completed, have
caused)B (I) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or
other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more
other protected computers) aggregating at least $5,000 in value,” 18 U.S.C. 1030(c)(4)(A)(i)(I).
170 18 U.S.C. 1030(c)(4)(A)(i), (c)(4)(B), 3571.
171 18 U.S.C. 1030(c)(4)(G), 3571.
Congressional Research Service
35

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

- imprisonment for not more than 5 years and/or a fine of not more than $250,000 (not more
than $500,000 for an organization), if the offense
• causes a loss that over the course of a year exceeds $5,000;173
• modifies, impairs, or could modify or impair medical services;
• causes physical injury;
• threatens public health or safety;
• affects a justice, national defense, or national security entity computer; or
• affects 10 or more protected computers over the course of a year.174
- imprisonment for not more than for not more than 1 year and/or a fine of not more than
$100,000 (not more than $200,000 for an organization), for any other violation of the
subparagraph.175
The punishment for a violation of subparagraph 1030(a)(5)(C)(intentional access that causes
damage and loss) is
- imprisonment for not more than 10 years and/or a fine of not more than $250,000 (not more
than $500,000 for an organization), if the defendant a prior conviction under subsections
1030(a) or (b);176
- imprisonment for not more than for not more than 1 year and/or a fine of not more than
$100,000 (not more than $200,000 for an organization), for any other violation of the
subparagraph.177
The section’s legislative history provides some insight into why the damage thresholds are set as
they are. In the case of damage in excess of $5,000, another earlier prohibition had spoken of
intrusions that “cause[d] loss or damage to one or more other persons of value aggregating
$1,000 or more during any 1-year period.”178 The Senate Committee report accompanying the
1996 amendments observed that use of the term “damage” contemplated the inclusion of all
economic harm attributable to the intrusion and that the increased dollar limitation was expected
to restrict federal felony prosecutions to the more serious cases:
The 1994 amendment required both ‘damage’ and ‘loss,’ but it is not always clear what
constitutes ‘damage.’ For example, intruders often alter existing log-on programs so that user

(...continued)
172 18 U.S.C. 1030(c)(4)(C), 3571.
173 More precisely, “(A)(i) ... if the offense caused (or, in the case of an attempted offense, would, if completed, have
caused)B (I) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or
other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more
other protected computers) aggregating at least $5,000 in value,” 18 U.S.C. 1030(c)(4)(A)(i)(I).
174 18 U.S.C. 1030(c)(4)(A)(i), 3571.
175 18 U.S.C. 1030(c)(4)(G), 3571.
176 18 U.S.C. 1030(c)(4)(D), 3571.
177 18 U.S.C. 1030(c)(4)(G), 3571.
178 18 U.S.C. 1030(a)(5)(A)(ii)(II)(1994 ed.)(emphasis added).
Congressional Research Service
36

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

passwords are copied to a file which the hackers can retrieve later. After retrieving the newly
created password file, the intruder restores the altered log-on file to its original condition.
Arguably, in such a situation, neither the computer nor its information is damaged.
Nonetheless, this conduct allows the intruder to accumulate valid user passwords to the
system, requires all system users to change their passwords, and requires the system
administrator to devote resources to resecuring the system. Thus, although there is arguably
no ‘damage,’ the victim does suffer ‘loss.’ If the loss to the victim meets the required
monetary threshold, the conduct should be criminal, and the victim should be entitled to
relief. The bill therefore defines ‘damage’ in new subsection 1030(e)(8), with a focus on the
harm that the law seeks to prevent. As in the past, the term ‘damage’ will require ...
significant financial losses. S.Rept. 104-357 at 11 (1996).
Ordinarily, the presence of a separate hacker prohibition with less severe penalties would argue
against allowing “damage assessment” and “security enhancement” costs to be used to reach
the $5,000 threshold for the more severe penalty. The report language might be read to rebut
such a presumption, but it might also be characterized as asserting no more than that the cost
of new locks (“resecuring the system”) can be considered damage when the keys (“passwords”)
are stolen.
The USA PATRIOT Act reduced the prospect of misconception by supplying an explicit
definition of “loss” as used here: “the term ‘loss’ means any reasonable cost to any victim,
including the cost of responding to an offense, conducting a damage assessment, and restoring the
data, program, system, or information to its condition prior to the offense, and any revenue lost,
cost incurred, or other consequential damages incurred because of interruption of service,” 18
U.S.C. 1030(e)(11). Thus, the losses incurred by a contractor employed to manage the damaged
computer system may properly be included to reach the $5,000 threshold.179
It also eliminated a second potential problem. The 1996 amendments, perhaps inadvertently,
rephrased the aggregate $5,000 damage-loss threshold describing the victims as “individuals”
rather than the term previously employed, “persons.”180 The change stimulated contentions that
Congress intended to limit the cases where the threshold could be reached entirely to the damages
and losses suffered by human beings without any reference to the damages and losses suffered by
corporate or other legal entities.181 The USA PATRIOT Act negated the problem by describing the
damage-loss victims as “persons” and by defining persons to include individuals and any “legal
or other entity.”182
The long-standing medical tampering element has no monetary threshold and has remained
essentially unchanged since it was added in response to an incident in which juvenile hackers
broke into the computer system of the Memorial Sloan-Kettering Cancer Center.183

179 United States v. Millot, 433 F.3d 1057, 1060-61 (8th Cir. 2006).
180 Compare “causes loss or damage to one or more other persons of value aggregating $1,000 or more during any
1-year period,” 18 U.S.C. 1030(a)(5)(A)(ii)(II)(aa)(1994 ed.) (emphasis added), with “causes loss aggregating at least
$5,000 in value during any 1-year period to one or more individuals,” 18 U.S.C. 1030(e)(8)(A)(2000 ed.)(emphasis
added).
181 The argument was made but rejected in United States v. Middleton, 231 F.3d 1207, 1210 (9th Cir. 2000).
182 18 U.S.C. 1030(a)(5)(B)(i), (e)(12).
183 S.Rept. 99-432 at 2-3 (1986). The medical records offense had always been tied to the use of interstate computers;
1996 amendments also permit prosecution when the medical records tampering involves one of the other four
jurisdictional moorings (i.e., the involvement of federal computers or the computers of financial institutes, or adversely
affecting the use of computers by the government or financial institutions).
Congressional Research Service
37

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

The inclusion of computer tampering that causes physical injuries or threatens public health or
safety, on the other hand, is new with the 1996 amendments and is designed to reach more
general threats:
As the NII [National Information Infrastructure] and other network infrastructures continue
to grow, computers will increasingly be used for access to critical services such as
emergency response systems and air traffic control, and will be critical to other systems
which we cannot yet anticipate. S.Rept. 104-357 at 11 (1996).
The last entry is the work of the Identity Theft Enforcement and Restitution Act.184 Its Senate
sponsor explained that it addressed
the increasing number of cyber attacks on multiple computers, by making it a felony to
employ spyware or keyloggers to damage 10 or more computers, regardless of the aggregate
amount of damage caused. By making this crime a felony, the bill ensures that the most
egregious identity thieves will not escape with minimal punishment under Federal cyber
crime laws. 153 Cong. Rec.S14570 (daily ed. Nov. 15, 2008)(remarks of Sen. Leahy).
Juveniles
Here as elsewhere, offenses committed by juveniles are more likely to result in state rather than
federal proceedings.185 Many of the other auxiliary provisions of law such as those relating to the
Sentencing Guidelines, forfeiture, and the like, which have little relevance in the case of simple
trespassing, may have real consequences in the case of the damage offenses proscribed in
paragraph 18 U.S.C. 1030(a)(5).
Sentencing Guidelines
The Sentencing Guidelines operate in paragraph 1030(a)(5) damage cases much as they do in
paragraph 1030(a)(2) information acquisition cases.186 The offenses are assigned to the same
guideline, U.S.S.G. §2B1.1. Some of that guideline’s escalators, however, are more obviously
relevant in damage cases. For example, there is a minimum enhancement of 4 levels when a
paragraph 1030(a)(5) offense involves the intentional infliction of damage,187 and another range
of enhancements when an offense has multiple victims.188 In addition, although the two offenses
trigger the same range of enhancements based on the extent of loss or damage caused by the
offense, the amount of damage or loss is often greater in a damage case.189

184 §204(a)(2)(C), P.L. 110-326, 122 Stat. 3562 (2008).
185 18 U.S.C. 5032.
186 See e.g., United States v. O’Brien, 435 F.3d 36, 41 (1st Cir. 2006)(“The district judge calculated the guideline range
... adding 6 levels for a loss of $25,000-$40,000, U.S.S.G. §2B1.1, and then adding 2 levels for obstruction of justice,
U.S.S.G. §3C1.1, and 2 levels for use of a special skill, U.S.S.G. §3B1.3”). The court noted that the special skill finding
was warranted given the defendant’s proficiency in the victimized software which permitted him to instruct others on
its use, id.
187 “(Apply the greatest) If the defendant was convicted of an offense under ...(ii) 18 U.S.C. 1030(a)(5)(A)
[intentionally damaging a protected computer], increase by 4 levels. (iii) 18 U.S.C. 1030, and the offense caused a
substantial disruption of a critical infrastructure, increase by 6 levels,” U.S.S.G. §2B1.1(b)(16)(A)(ii), (iii).
188 “(Apply the greatest) If the offense – (A) (i) involved 10 or more victims ... increase by 2 levels; (B) involved 50 or
more victims, increase by 4 levels; or (C) involved 250 or more victims, increase by 6 levels,” U.S.S.G. §2B1.1(b)(2).
189 U.S.S.G. §2B1.1(b)(1). Accompanying Application Note (3)(A)(v)(III) provides, “Offenses Under 18 U.S.C.
(continued...)
Congressional Research Service
38

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Forfeiture and Restitution
Property derived from, or facilitating the commission of, a violation of any paragraph of 18
U.S.C. 1030 is subject to confiscation.190 Restitution is mandatory when related to a violation of a
paragraph which proscribes fraud or property damage,191 and is fairly common.192 When
confiscation was limited to the offender’s ill-gotten gains, forfeiture in a damage case was
uncommon. Confiscation may become more prevalent now that property used to inflict damage in
violation of paragraph 1030(a)(5) is subject to forfeiture.193
Cause of Action
Regardless of the criminal sanctions imposed, offenders of paragraph 1030(a)(5) may also incur
civil liability for serious damage caused.194 Victims of a violation of paragraph 1030(a)(5) or any
violation of subsection 1030(a) resulting in the requisite serious harm have a cause of action for
damages and equitable relief if suit is brought within two years.195 Damages to medical records,
or damage causing physical injury or endangering public safety, or damage of certain government
computers may also subject the offender to “compensatory” damages beyond “economic”

(...continued)
§1030.—In the case of an offense under 18 U.S.C. §1030, actual loss includes the following pecuniary harm, regardless
of whether such pecuniary harm was reasonably foreseeable: any reasonable cost to any victim, including the cost of
responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to
its condition prior to the offense, and any revenue lost, cost incurred, or other damages incurred because of interruption
of service.”
190 18 U.S.C. 981(a)(1)(C), 982(a)(2)(B), 1030(i),(j).
191 18 U.S.C. 3663A(c)(1)(A)(ii).
192 E.g., United States v. Shea, 493 F.3d 1110, 1114 (9th Cir. 2007); United States v. Perry, 479 F.3d 885, 888 (D.C.
Cir. 2007); United States v. Phillips, 477 F.3d 215, 217 (5th Cir. 2007); United States v. Schuster, 467 F.3d 614, 616
(7th Cir. 2006); United States v. Millot, 433 F.3d 1057, 1060 (8th Cir. 2006).
193 §208 of the Identity Theft Enforcement and Restitution Act, P.L. 110-326, 122 Stat. 3563 (2008), amended §1030 to
authorize both civil and criminal forfeiture of property used to facilitate a violation of the section, 18 U.S.C. 1030(i),
(j).
194 18 U.S.C. 1030(g)(“Any person who suffers damage or loss by reason of a violation of this section may maintain a
civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil
action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in subclause
(I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i). Damages for a violation involving only conduct described in
subsection (a)(4)(A)(i)(I) are limited to economic damages. No action may be brought under this subsection unless
such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage. No
action may be brought under this subsection for the negligent design or manufacture of computer hardware, computer
software, or firmware,” 18 U.S.C. 1030(g).
The damages described in clauses (c)(4)(A)(i)(I) through (V) are: “(I) loss to 1 or more persons during any 1-year
period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss
resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in
value; (II) the modification or impairment, or potential modification or impairment, of the medical examination,
diagnosis, treatment, or care of 1 or more individuals; (III) physical injury to any person; (IV) a threat to public health
or safety; or (V) damage affecting a computer system used by or for a government entity in furtherance of the
administration of justice, national defense, or national security.” See, America Online, Inc. v. National Health Care
Discount, Inc.,
174 F.Supp.2d 890, 899 (N.D. Iowa 2001)(sending bulk unauthorized and unsolicited e-mail to the
Internet service provider’s customers violated paragraph 1030(a)(2)).
Although subsection 1030(g) applies to any violation under any of the paragraphs of §1030, it is discussed at greater
length below in connection with paragraph 1030(a)(5)(relating to inflicting damage upon a computer).
195 Id.
Congressional Research Service
39

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

damages—a difference that may entitle a victim to pecuniary damages as well as damages for
pain and suffering but probably not exemplary damages.196 When the victim’s claim is based
solely upon the fact that more than $5,000 worth of harm has been inflicted, recovery is limited to
economic damages.197
A victim is described as “any person who suffers loss or damage by reason of a violation of this
section,” but initially there was no specific definition of the term “person” in either Section 1030
or in the definitions applicable to Title 18 generally.198 The legislative history offered no further
edification and the courts had left the issue unaddressed. “Person” could have meant individuals,
or individuals and other legal entities including governmental entities, or individuals and other
legal entities but not including governmental entities. Credible arguments could have been
advanced for each of the possible readings, but the fact that Congress elected to use the term
“person” to mean only individuals in paragraph 1030(a)(7)(extortionate threats)199 might have
seemed to favor a similar interpretation in subsection 1030(g). The USA PATRIOT Act resolved
the question and answered several others.
First, it supplied a definition of person—“the term ‘person’ means any individual, firm,
corporation, educational institution, governmental entity, or legal or other entity.”200 Then, it
added an equally generous definition of the kinds of losses that might give rise to civil liability—
“the term ‘loss’ means any reasonable cost to any victim, including the cost of responding to an
offense, conducting a damage assessment, and restoring the data, program, system, or information
to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential
damages incurred because of interruption of service.”201 Finally, it made clear that subsection
1030(g) does not create a cause of action for loss or damage attributable to “the negligent design
or manufacture of computer hardware, computer software, or firmware,” 18 U.S.C. 1030(g).202

196 Black’s defines compensatory damages as those damages “sufficient in amount to indemnify the injured person for
the loss suffered,” BLACK’S LAW DICTIONARY, Damages (8th ed. 2004). It recognizes no separate definition for
“economic damages,” but the term is defined elsewhere in Title 18 of the United States Code as “the replacement costs
of lost or damaged property or records, the cost of repeating an interrupted or invalidated experiment, or the loss of
profits,” 18 U.S.C. 43(d)(3).
197 18 U.S.C. 1030(g).
198 The courts have extended the right to civil remedies under the statute to third parties. The court in Theofel v. Farey-
Jones
, 359 F.3d 1066, 1078 (9th Cir. 2004), emphasized that the statute extends a civil remedy to any person who
suffers loss or damage, thus “[i]ndividuals other than the computer’s owner may be proximately harmed by
unauthorized access, particularly if they have rights to data stored on it.”
199 “Whoever ... (7) with intent to extort from any person, firm, association, educational institution, financial
institution, government entity, or other legal entity
, any money or other thing of value ...” 18 U.S.C. 1030(a)(7)
(emphasis added)(the 2002 amendments struck out “firm, association, educational institution, financial institution,
government entity, or other legal entity”).
200 18 U.S.C. 1030(e)(12).
201 18 U.S.C. 1030(e)(11).
202 For some of the difficulties associated with possible manufacturer liability under subsection 1030(g) prior to
amendment see, In re America Online, Inc., 168 F.Supp.2d 1359 (S.D.Fla. 2001)(allegations that provider’s software
damaged customers’ computers); Thurmond v. Compaq Computer Corp., 171 F.Supp.2d 667 (E.D. Tex. 2001)(floppy
disk controllers that allegedly corrupted or destroyed data); Hayes v. Packard Bell NEC, Inc., 193 F.Supp.2d 910
(E.D.Tex. 2001)(same); Christian v. Sony Corp. of America, 152 F.Supp.2d 1184 (D.Minn. 2001)(same).
Congressional Research Service
40

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Crimes of Terrorism
Several consequences flow from designation of an offense as a federal crime of terrorism.
Among the paragraph 1030(a) offenses only the paragraph (a)(1) espionage offenses and the
paragraph (a)(5) serious damage offenses (not including those considered serious only because
they involve damage in excess of $5,000) have been classified as federal crimes of terrorism.203
Designation as a federal crime of terrorism triggers the application of several other substantive
and procedural criminal statutes, regardless of any further nexus to terrorism. Federal crimes of
terrorism are subject to an 8-year statute of limitations rather than the 5-year period that governs
most federal crimes.204 The maximum term of supervised release for a federal crime of terrorism
is life, rather than the 5-year maximum that applies in most other instances.205 An individual
charged with a federal crime of terrorism is presumed to be an inappropriate subject for release on
bail prior to his criminal trial.206 The maximum term of imprisonment for aggravated identity
theft is 5 years when the offense is committed in relation to a federal crime of terrorism rather
than the 2-year maximum that would otherwise apply.207 It is a separate federal crime punishable
by imprisonment for any term of years or for life to knowingly provide maritime transportation to
an individual intending to commit, or in flight from the commission of, a federal crime of
terrorism.208
Federal crimes of terrorism are also by definition RICO predicate offenses.209 Among other
things, RICO outlaws the patterned commission of predicate offenses (“racketeering activities”)
in order to acquire or conduct the affairs of an enterprise whose activities affect interstate or
foreign commerce.210 Offenders face imprisonment for up to 20 years, as well as the prospect of
civil liability.211 Any RICO predicate offense is in turn a money laundering predicate offense
under 18 U.S.C. 1956 which among other things outlaws laundering the proceeds of a predicate
offense or plowing them back into further predicate offenses.

203 The USA PATRIOT Act enlarged the definition of federal crimes of terrorism, 18 U.S.C. 2332b(g)(5)(B), to include
intentionally damaging a protected computer if the offense involves either impairing medical care, causing physical
injury, threatening public health or safety, or damaging a governmental justice, national defense, or national security
computer system, 18 U.S.C. 2332b(g)(5)(B)(i)(“t[T]e term ‘federal crime of terrorism means’ means an offense that ...
(B) is a violation of – (i) section ... 1030(a)(5)(A) resulting in damage as defined in 1030(c)(4)(A)(i)(I) through (VI) ...
of this title”).
204 18 U.S.C. 3286(a). A federal crime of terrorism that results in or involves the risk of serious injury can be
prosecuted at any time, 18 U.S.C. 3286(b).
205 18 U.S.C. 3583. Federal courts generally impose a term of supervised release whenever they sentence an offender to
prison for more than one year, id., U.S.S.G. §5D1.1. Other than for certain drug offenses and sex crimes, the maximum
length of a term of supervised release is 5 years, 18 U.S.C. 3583(b). Conditions of supervised release are not unlike
those for probation or parole; the offender comes under the supervision of the Probation Service subject to court
designated restrictions and obligations, 18 U.S.C. 3583(d).
206 18 U.S.C. 3143(e).
207 18 U.S.C. 1028A.
208 18 U.S.C. 2284.
209 18 U.S.C. 1961(1).
210 “(b) It shall be unlawful for any person through a pattern of racketeering activity or through collection of an
unlawful debt to acquire or maintain, directly or indirectly, any interest in or control of any enterprise which is engaged
in, or the activities of which affect, interstate or foreign commerce.
“(c) It shall be unlawful for any person employed by or associated with any enterprise engaged in, or the activities
of which affect, interstate or foreign commerce, to conduct or participate, directly or indirectly, in the conduct of such
enterprise’s affairs through a pattern of racketeering activity or collection of unlawful debt,” 18 U.S.C. 1962(b), (c).
211 18 U.S.C. 1963, 1964.
Congressional Research Service
41

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Attempt, Conspiracy, and Complicity
The same general observations concerning attempt, conspiracy, and aiding and abetting noted for
the simple trespass paragraph apply here. It is a separate crime to attempt or conspire to violate
paragraph 1030(a)(5) or any of the other paragraphs of subsection 1030(a).212 Those who attempt
or conspire to violate, or who aid and abet the violation of another, are subject to the same
penalties as those who commit the substantive offense.213
Other Crimes
Damage or Destruction of Federal Property
There are more than a few other federal statutes that might be implicated by damage or
destruction of federal property, of the property of financial institutions, or of property used in
interstate or foreign commerce. The principal uncertainty is whether these general statutes can be
applied to protect intangible property, like information in computer storage. Even if computer-
stored data is considered tangible property (electronic files rather than paper files), several
statutes that outlaw damage or destruction may be unavailable because they either call for a
specific means of destruction (destruction by fire or explosives) or because they protect a
particular kind of property (timber or buildings).214
Destruction of Government Records. It is a federal crime for anyone to unlawfully “conceal,
remove, mutilate, obliterate, or destroy ... any record, proceeding, map, book, paper, document, or
other thing, filed or deposited with ... any judicial or public officer of the United States.”215 The
damage or destruction of government, computer-stored records will fall within the coverage of
Section 2071 only if it can meet each of the action (obliterate or destroy), object (any record or
other thing) and place (filed with a federal judicial or public officer) tests.
The phrase “conceal, remove, mutilate, obliterate, or destroy” may lend itself to the argument that
it extends to destruction or complete inaccessibility, but perhaps not to less than totally
destructive damage, of computerized records. Electronic destruction seems to fit under either

212 18 U.S.C. 1030(b).
213 18 U.S.C. 1030(b), (c), 2.
214 “(f)(1) Whoever maliciously damages or destroys, or attempts to damage or destroy, by means of fire or an
explosive
, any building, vehicle, or other personal or real property in whole or in part owned or possessed by, or leased
to, the United States, or any department or agency thereof, shall be imprisoned for not less than 5 years and not more
than 20 years, fined under this title, or both.... 18 U.S.C. 844(f)(emphasis added).
“Whoever unlawfully cuts, or wantonly injures or destroys any tree growing, standing, or being upon any land of
the United States ... shall be fined under this title or imprisoned not more than one year, or both,” 18 U.S.C. 1853.
215 “(a) Whoever willfully and unlawfully conceals, removes, mutilates, obliterates, or destroys, or attempts to do so, or,
with intent to do so takes and carries away any record, proceeding, map, book, paper, document, or other thing, filed or
deposited with any clerk or officer of any court of the United States, or in any public office, or with any judicial or
public officer of the United States, shall be fined under this title or imprisoned not more than three years, or both.
“(b) Whoever, having the custody of any such record, proceeding, map, book, document, paper, or other thing,
willfully and unlawfully conceals, removes, mutilates, obliterates, falsifies, or destroys the same, shall be fined under
this title or imprisoned not more than three years, or both; and shall forfeit his office and be disqualified from holding
any office under the United States. As used in this subsection, the term “office” does not include the office held by any
person as a retired officer of the Armed Forces of the United States,” 18 U.S.C. 2071.
Congressional Research Service
42

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

“obliterate” (“to make undecipherable by obscuring”)216 or “destroy.” Absent obliteration or
destruction, the section may be thought to protect only tangibles, since the word “mutilate” has
obvious physical connotations. Yet one court among the few to construe Section 2071 held that it
did not prohibit photocopying of government records—not because that would constitute the
removal of an intangible (information), but because the statute was designed to prevent “any
conduct which deprives the Government of the use of its documents.”217
The phrase “any record, proceeding, map, book, paper, document, or other thing, filed or
deposited with” would seem to cover any “thing” capable of being “filed or deposited.” In these
days of “electronic filing”218 any contention that federal computer records do not fit the phrase
seems untenable.
The final requirement might appear to protect only those records based on deposits with federal
court or administrative officials, but the scant case law available suggests coverage extends to any
record maintained by the government.219
Violations of Section 2071 are punishable by imprisonment for not more than three years and/or a
fine of not more than $250,000, or both fine and imprisonment, 18 U.S.C. 2071, 3571.
Destruction of Federal Property. It is a federal crime to “willfully injure or commit any
depredation against any property of the United States....”220 Although an offender must be shown
to have to injured or depredated the property, the government need not show that the defendant
knew the property belonged to the government.221 The federal courts have permitted prosecution
under Section 1361 of a defendant who used a hammer and drill to destroy a federal computer.222
There does not appear to be any reported cases in which Section 1361 was used to prosecute
electronic computer abuse for damaging federal property, and federal authorities used an earlier

216 MERRIAM WEBSTER’S COLLEGIATE DICTIONARY, 802 (10th ed. 1996).
217 United States v. Rosner, 352 F.Supp. 915, 919 (S.D.N.Y. 1972).
218 See, e.g., 26 U.S.C. 6011(e)(1)(“The Secretary shall prescribe regulations providing standards for determining
which returns must be filed on magnetic media or in other machine-readable form.”); IRS Pub. 3112 (2007); 26 C.F.R.
§301.7502-1(d) (“Electronically filed documentsB (1) In general. A document filed electronically with an electronic
return transmitter ... in the manner and time prescribed by the Commissioner is deemed to be filed on the date of the
electronic postmark ... given by the authorized electronic return transmitter. Thus, if the electronic postmark is timely,
the document is considered filed timely although it is received by the agency, officer, or office after the last date, or the
last day of the period, prescribed for filing such document”).
219 United States v. Lang, 364 F.3d 1210 (10th Cir. 2004)(copy of officially filed court document), rem’d for
reconsideration in light of United States v. Booker, 543 U.S. 220 (2005), reinstated in part, 405 F.3d 1060 (10th Cir.
2005);United States v. Poindexter, 725 F.Supp. 13, 19 (D.D.C. 1989)(National Security Council records); Coplon v.
United States
, 191 F.2d 749 (D.C.Cir. 1951)(FBI counter-intelligence reports).
220 “Whoever willfully injures or commits any depredation against any property of the United States, or of any
department or agency thereof, or any property which has been or is being manufactured or constructed for the United
States, or any department or agency thereof, or attempts to commit any of the foregoing offenses, shall be punished as
follows:
“If the damage or attempted damage to such property exceeds the sum of $1,000, by a fine under this title or
imprisonment for not more than ten years, or both; if the damage or attempted damage to such property does not exceed
the sum of $1,000, by a fine under this title or by imprisonment for not more than one year, or both.” 18 U.S.C. 1361.
221 United States v. Urfer 287 F.3d 663, 666 (7th Cir. 2002); but see, United States v. Bangert, 645 F.2d 1297, 1305 (8th
Cir. 1981).
222 United States v. Komisaruk, 885 F.2d 490 (9th Cir. 1989).
Congressional Research Service
43

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

version of the computer abuse statute, 18 U.S.C. 1030, to prosecute one of the first cases of
electronic computer abuse resulting in damage.223
Damage or destruction of federal property is punishable by imprisonment for not more than 10
years and/or a fine of not more than $250,000 (or not more than one year and/or a fine of not
more than $100,000 if the damage causes amounts to $1,000 or less and no one dies as a result of
the offense).224
Destruction of Federal Communications Systems. Willful or malicious interference or disruption
“in any way” with any communications system owned by the United States or used by the United
States for military or civil defense purposes is punishable by imprisonment for not more than
10 years and/or a fine of not more than $250,000.225 The language of Section 1362 leaves little
room for any contention that it does not apply to computer abuse aimed at federal
communications facilities.
Damage or Destruction of Financial Institution Property
A handful of federal statutes protect financial institutions from theft in one form or another, but
not property damage or destruction. Section 1030 appears to be the only statute that includes a
specific provision designed to protect the property of financial institutions from damage or
destruction. As with Morris, a defendant prosecuted under an earlier version of paragraph
1030(a)(5) questioned what level of intent was required with respect to the damage caused.226
Damage or Destruction to Property in Interstate Commerce
Transportation. The federal statutes, other than paragraph 1030(a)(5), most likely to cover the
computerized damage or destruction to property in interstate commerce, involve transportation.
Each of the provisions that proscribe interference with air, motor, rail and sea transportation
appear to have been drafted with sufficient breadth to reach damage or destruction of at least
some of the computer systems incidental to those transportation facilities.

223 United States v. Morris, 928 F.2d 504 (2d Cir. 1991).
224 Organizations are subject to fines of not more than $500,000 if they cause more than $1,000 in damage and not
more than $200,000 otherwise, 18 U.S.C. 1361, 3571.
225 18 U.S.C. 1362, 3571. §1362 provides in full that: “Whoever willfully or maliciously injures or destroys any of the
works, property, or material of any radio, telegraph, telephone or cable, line, station, or system, or other means of
communication, operated or controlled by the United States, or used or intended to be used for military or civil defense
functions of the United States, whether constructed or in process of construction, or willfully or maliciously interferes
in any way with the working or use of any such line, or system, or willfully or maliciously obstructs, hinders, or delays
the transmission of any communication over any such line, or system, or attempts or conspires to do such an act, shall
be fined under this title or imprisoned not more than ten years, or both.
“In the case of any works, property, or material, not operated or controlled by the United States, this section shall
not apply to any lawful strike activity, or other lawful concerted activities for the purposes of collective bargaining or
other mutual aid and protection which do not injure or destroy any line or system used or intended to be used for the
military or civil defense functions of the United States.”
226 United States v. Sablan, 92 F.3d 865, 867-69 (9th Cir. 1996). As originally worded, the paragraph penalized anyone
who “intentionally accesse[d] a Federal interstate computer ... and by means of ... such conduct ... damage[d] ...
information in such ... computer,” 18 U.S.C. 1030(a)(5)(1988 ed.). Defendants in Morris and Sablan argued
unsuccessfully that the government was required to show that the offender had both intentionally accessed a federal
computer and had intentionally damaged information in the computer. The current wording eliminates the grounds for
such contentions.
Congressional Research Service
44

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

For example, the provisions applicable to the destruction of aircraft and aircraft facilities penalize
anyone who “damages, destroys, or disables any air navigation facility ... if such ... damaging,
destroying, [or] disabling ... is likely to endanger the safety of any such aircraft.”227 This would
presumably protect air traffic control systems, but not computerized passenger information, that
is, gridlock is not proscribed unless it “endanger[s] the safety” of air travel.
The language of the provisions outlawing interference with maritime navigation is strikingly
comparable: “a person who unlawfully and intentionally ... destroys or seriously damages
maritime navigational facilities or seriously interferes with their operation, if such act is likely to
endanger the safe navigation of a ship” or attempts or conspires to do so is punishable by
imprisonment for not more than 20 years and/or a fine of not more than $250,000, or if death
results from commission of the offense, by imprisonment for life or death.228 Federal jurisdiction

227 18 U.S.C. 32(a)(3). Violations, attempted violations, and conspiracies to violate the provisions of §32 are all
punishable by imprisonment for not more than 20 years and/or a fine of not more than $250,000 (not more than
$500,000 for organizations), 18 U.S.C. 32(a), 3571; violations that result in death are punishable by life imprisonment
or death, 18 U.S.C. 34. §32 reads in pertinent part: “(a) Whoever willfully—(1) sets fire to, damages, destroys,
disables, or wrecks any aircraft in the special aircraft jurisdiction of the United States or any civil aircraft used,
operated, or employed in interstate, overseas, or foreign air commerce; (2) places or causes to be placed a destructive
device or substance in, upon, or in proximity to, or otherwise makes or causes to be made unworkable or unusable or
hazardous to work or use, any such aircraft, or any part or other materials used or intended to be used in connection
with the operation of such aircraft, if such placing or causing to be placed or such making or causing to be made is
likely to endanger the safety of any such aircraft; (3) sets fire to, damages, destroys, or disables any air navigation
facility, or interferes by force or violence with the operation of such facility, if such fire, damaging, destroying,
disabling, or interfering is likely to endanger the safety of any such aircraft in flight; (4) with the intent to damage,
destroy, or disable any such aircraft, sets fire to, damages, destroys, or disables or places a destructive device or
substance in, upon, or in proximity to, any appliance or structure, ramp, landing area, property, machine, or apparatus,
or any facility or other material used, or intended to be used, in connection with the operation, maintenance, loading,
unloading or storage of any such aircraft or any cargo carried or intended to be carried on any such aircraft; (5)
interferes or disables, with intent to endanger the safety of any person or with a reckless disregard for the safety of
human life, anyone engaged in the authorized operation of such aircraft or any air navigation facility aiding in the
navigation of any such aircraft; (6)performs an act of violence against or incapacitates any individual on any such
aircraft, if such act of violence or incapacitation is likely to endanger the safety of such aircraft; (7) communicates
information, knowing the information to be false and under circumstances in which such information may reasonably
be believed, thereby endangering the safety of any such aircraft in flight; or (8) attempts or conspires to do anything
prohibited under paragraphs (1) through (7) of this subsection;
shall be fined under this title or imprisoned not more than twenty years or both.
“(b) Whoever willfully ... (2) destroys a civil aircraft registered in a country other than the United States while such
aircraft is in service or causes damage to such an aircraft which renders that aircraft incapable of flight or which is
likely to endanger that aircraft’s safety in flight; ... or (4) attempts or conspires to commit an offense described in
paragraphs (1) through (3) of this subsection;
shall be fined under this title or imprisoned not more than twenty years, or both. There is jurisdiction over an offense
under this subsection if a national of the United States was on board, or would have been on board, the aircraft; an
offender is a national of the United States; or an offender is afterwards found in the United States....
“(c) Whoever willfully imparts or conveys any threat to do an act which would violate any of paragraphs (1) through
(5) of subsection (a) or any of paragraphs (1) through (3) of subsection (b) of this section, with an apparent
determination and will to carry the threat into execution shall be fined under this title or imprisoned not more than five
years, or both.”
228 18 U.S.C. 2280; 18 U.S.C. 3571. §2280 provides in pertinent part: “(a)(1) In general.B A person who unlawfully and
intentionally ... (C) destroys a ship or causes damage to a ship or to its cargo which is likely to endanger the safe
navigation of that ship; (D) places or causes to be placed on a ship, by any means whatsoever, a device or substance
which is likely to destroy that ship, or cause damage to that ship or its cargo which endangers or is likely to endanger
the safe navigation of that ship; (E) destroys or seriously damages maritime navigational facilities or seriously
interferes with their operation, if such act is likely to endanger the safe navigation of a ship; (F) communicates
information, knowing the information to be false and under circumstances in which such information may reasonably
be believed, thereby endangering the safe navigation of a ship; (G) injures or kills any person in connection with the
(continued...)
Congressional Research Service
45

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

for prosecution exists if the offense occurs within American territorial waters, if the vessel or
vessels engaged are of American registry, or if committed by an American or by someone later
found in this country.229
Similarly, attacks on mass transit are punishable by imprisonment for not more than 20 years
and/or a fine of not more than $250,000 (not more than $500,000 for organizations), and if death
results from commission of the offense, by imprisonment for life or death.230 Once again,
computer abuse that targets rail traffic control is almost certainly covered; computer abuse that
targets ticket control is almost certainly not.
The language of the federal law outlawing the destruction of motor vehicle facilities seems only
slightly more modest, for it extends to anyone who “with a reckless disregard for the safety of
human life,” willfully “damages, destroys ... tampers with,” or otherwise makes “unworkable,
unusable, or hazardous to work or use” any “facility used in the operation of, or in support of the
operation of, motor vehicles engaged in interstate or foreign commerce,” 18 U.S.C. 33(a).231

(...continued)
commission or the attempted commission of any of the offenses set forth in subparagraphs (A) through (F); or (H)
attempts or conspires to do any act prohibited under subparagraphs (A) through (G),
shall be fined under this title, imprisoned not more than 20 years, or both; and if the death of any person results from
conduct prohibited by this paragraph, shall be punished by death or imprisoned for any term of years or for life.
“(2) Threat to navigation.—A person who threatens to do any act prohibited under paragraph (1) (B), (C) or (E),
with apparent determination and will to carry the threat into execution, if the threatened act is likely to endanger the
safe navigation of the ship in question, shall be fined under this title, imprisoned not more than 5 years, or both.
“(b) Jurisdiction.BThere is jurisdiction over the activity prohibited in subsection (a)—(1) in the case of a covered
ship, if—(A) such activity is committed—(i) against or on board a ship flying the flag of the United States at the time
the prohibited activity is committed; (ii) in the United States; or (iii) by a national of the United States or by a stateless
person whose habitual residence is in the United States; (B) during the commission of such activity, a national of the
United States is seized, threatened, injured or killed; or (C) the offender is later found in the United States after such
activity is committed;
“(2) in the case of a ship navigating or scheduled to navigate solely within the territorial sea or internal waters of a
country other than the United States, if the offender is later found in the United States after such activity is committed;
and
“(3) in the case of any vessel, if such activity is committed in an attempt to compel the United States to do or abstain
from doing any act....
“(e) Definitions.B In this section—‘covered ship’ means a ship that is navigating or is scheduled to navigate into,
through or from waters beyond the outer limit of the territorial sea of a single country or a lateral limit of that country’s
territorial sea with an adjacent country; ‘national of the United States’ has the meaning stated in Section 101(a)(22) of
the Immigration and Nationality Act (8 U.S.C. 1101(a)(22)); ‘territorial sea of the United States’ means all waters
extending seaward to 12 nautical miles from the baselines of the United States determined in accordance with
international law; ‘ship’ means a vessel of any type whatsoever not permanently attached to the sea-bed, including
dynamically supported craft, submersibles or any other floating craft, but does not include a warship, a ship owned or
operated by a government when being used as a naval auxiliary or for customs or police purposes, or a ship which has
been withdrawn from navigation or laid up; ‘United States,’ when used in a geographical sense, includes the
Commonwealth of Puerto Rico, the Commonwealth of the Northern Mariana Islands and all territories and possessions
of the United States.”
229 18 U.S.C. 2280(b).
230 18 U.S.C. 1992, 3571.
231 Violations are punishable by imprisonment for not more than 20 years and/or a fine of not more than $250,000 (not
more than $500,000 for organizations) or, if death results from commission of the offense, by imprisonment for life or
death, 18 U.S.C. 33(a); 18 U.S.C. 34, 3571.
§18 U.S.C. 33 states in full: “(a) Whoever willfully, with intent to endanger the safety of any person on board or
anyone who he believes will board the same, or with a reckless disregard for the safety of human life, damages,
(continued...)
Congressional Research Service
46

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Computer abuse that damages or destroys motor traffic control systems in a manner threatening to
human safety would seem to fall within the reach of Section 33.
Other Damage Crimes. Other federal crimes that might be implicated by damaging computer
systems used in interstate or foreign commerce include those that cover damage to an energy
facility232 or proscribe interference with the operation of a communications or weather satellite.233
Most of the states also outlaw damaging computer equipment, software, or systems.234

(...continued)
disables, destroys, tampers with, or places or causes to be placed any explosive or other destructive substance in, upon,
or in proximity to, any motor vehicle which is used, operated, or employed in interstate or foreign commerce, or its
cargo or material used or intended to be used in connection with its operation; or
“Whoever willfully, with like intent, damages, disables, destroys, sets fire to, tampers with, or places or causes to be
placed any explosive or other destructive substance in, upon, or in proximity to any garage, terminal, structure, supply,
or facility used in the operation of, or in support of the operation of, motor vehicles engaged in interstate or foreign
commerce or otherwise makes or causes such property to be made unworkable, unusable, or hazardous to work or use;
or
“Whoever, with like intent, willfully disables or incapacitates any driver or person employed in connection with the
operation or maintenance of the motor vehicle, or in any way lessens the ability of such person to perform his duties as
such; or
“Whoever willfully attempts to do any of the aforesaid acts B
shall be fined under this title or imprisoned not more than twenty years, or both.
“(b) Whoever is convicted of a violation of subsection (a) involving a motor vehicle that, at the time the violation
occurred, carried high-level radioactive waste (as that term is defined in section 2(12) of the Nuclear Waste Policy Act
of 1982 (42 U.S.C. 10101(12))) or spent nuclear fuel (as that term is defined in section 2(23) of the Nuclear Waste
Policy Act of 1982 (42 U.S.C. 10101(23))), shall be fined under this title and imprisoned for any term of years not less
than 30, or for life.
232 “(a) Whoever knowingly and willfully damages or attempts to damage the property of an energy facility in an
amount that in fact exceeds or would if the attempted offense had been completed have exceeded $100,000, or damages
or attempts to damage the property of an energy facility in any amount and causes or attempts to cause a significant
interruption or impairment of a function of an energy facility, shall be punishable by a fine under this title or
imprisonment for not more than 20 years, or both.
“(b) Whoever knowingly and willfully damages or attempts to damage the property of an energy facility in an
amount that in fact exceeds or would if the attempted offense had been completed have exceeded $5,000 shall be
punishable by a fine under this title, or imprisonment for not more than five years, or both.
“(c) For purposes of this section, the term ‘energy facility’ means a facility that is involved in the production,
storage, transmission, or distribution of electricity, fuel, or another form or source of energy, or research, development,
or demonstration facilities relating thereto, regardless of whether such facility is still under construction or is otherwise
not functioning, except a facility subject to the jurisdiction, administration, or in the custody of the Nuclear Regulatory
Commission or an interstate gas pipeline facility as defined in section 60101 of title 49.
“(d) Whoever is convicted of a violation of subsection (a) or (b) that has resulted in the death of any person shall be
subject to imprisonment for any term of years or life,” 18 U.S.C. 1366.
233 (a) Whoever, without the authority of the satellite operator, intentionally or maliciously interferes with the
authorized operation of a communications or weather satellite or obstructs or hinders any satellite transmission shall be
fined in accordance with this title or imprisoned not more than ten years or both,” 18 U.S.C. 1367.
234 See, e.g., ALA.CODE §§13A-8-102, 13A-8-103; ALASKA STAT. §§11.46.482, 11/46/484; ARIZ. REV.STAT.ANN. §13-
2316; ARK.CODEANN. §5-41-202; CAL.PENAL CODE §502; COLO.REV. STAT.ANN. §18-5.5-102; CONN.GEN.STAT.ANN.
§53a-251; DEL.CODEANN. tit.11 §§934, 936; FLA. STAT.ANN. §§815.04, 815.06; GA.CODEANN. §16-9-93; HAWAII
REV.STAT. §§708-892, 708-892.5; IDAHO CODE §18-2202; ILL.COMP.LAWS ANN. ch.720 §§5/16D-3, 5/16D-4; IND.
CODE ANN. §35-43-1-4; IOWA CODE ANN. §716.6B; KAN.STAT.ANN. §21-3755; KY. REV.STAT.ANN. §§434.850,
434.851; LA.REV.STAT.ANN. §§14:73.2 to 14:73.4, 14:73.7; ME. REV.STAT.ANN. tit.17-A §433; MD.CRIM.CODE ANN.
§7-302; MASS GEN. LAWS ANN. ch. 266, §127; MICH.COMP.LAWS ANN. §752.795; MINN. STAT.ANN. §609.88; MISS.
CODE ANN. §§97-45-7, 97-45-9; MO.ANN.STAT. §§569.095 to 569.099; MONT.CODE ANN. §45-6-311; NEB.REV.STAT.
§28-1345; NEV.REV. STAT. §205.4765; N.H. REV.STAT.ANN. §638:17;N.J.STAT.ANN. §2C:20-25; N.MEX.STAT. ANN.
(continued...)
Congressional Research Service
47

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

RICO
Those paragraph 1030(a)(5) damage offenses that qualify as federal crimes of terrorism—
damaging a protected computer and thereby impairing medical care, causing physical injury, or
threatening public health or safety; or damaging a governmental justice, national defense, or
national security computer system—are by virtue of that fact RICO predicate offenses.235 Among
other things, RICO outlaws conducting the business of a commercial enterprise through the
patterned commission of predicate offenses.236
Violations are punishable by (a) forfeiture of any property acquired through a RICO violation and
of any property interest in the enterprise involved in the violation, and (b) imprisonment for not
more than 20 years, or life if one of the predicate offenses carries such a penalty, and/or a fine of
not more than $250,000 (not more than $500,000 for organizations).237
RICO violations also subject the offender to civil liability. The courts may award anyone injured
by a RICO violation treble damages, costs and attorneys’ fees, and may enjoin RICO violations,
order divestiture, dissolution or reorganization, or restrict an offender’s future professional or
investment activities.238
Money Laundering
The principal federal money laundering statutes, 18 U.S.C. 1956 and 1957, outlaw various
financial activities that involve the proceeds from other federal crimes.239 They prohibit
• domestic laundering of the proceeds of these predicate offenses, referred to as
“specified unlawful activities;”
• international laundering of the proceeds of predicate offenses;
• using the proceeds of predicate offenses to promote further predicate offenses;240
or

(...continued)
§30-45-4; N.Y.PENAL LAW §§156.10 to 156.27; N.C.GEN.STAT. §§14-455 to 14-458; N.D. CENT. CODE §12.1-06.1-08;
OHIO REV.CODE ANN. §2913.04; OKLA.STAT.ANN. tit.21 §1953; ORE.REV.STAT. §164.377; PA. STAT. ANN. tit.18
§§7612, 7615, 7616; R.I.GEN.LAWS §§11-52-3, 11-52-4.1; S.C.CODE ANN. §16-16-20; S.D.COD. LAWS §43-43B-1;
TENN. CODE ANN. §39-14-602; TEX.PENAL CODE ANN. §33.02; UTAH CODE ANN. §76-6-703; VT.STAT.ANN. tit.13
§§4104-4105; VA.CODE. §18.2-152.4; WASH.REV.CODE ANN. §§9A.48.070 to 9A.48.100; W.VA.CODE ANN. §61-3C-7;
WIS. STAT.ANN. §943.70; WYO.STAT. §§6-3-501 to 6-3-504.
235 18 U.S.C. 1961(1), 2332b(g)(5)(B).
236 “It shall be unlawful for any person employed by or associated with any enterprise engaged in, or the activities of
which affect, interstate or foreign commerce, to conduct or participate, directly or indirectly, in the conduct of such
enterprise’s affairs through a pattern of racketeering activity or collection of unlawful debt.
“(d) It shall be unlawful for any person to conspire to violate any of the provisions of subsection ... (c) of this
section,” 18 U.S.C. 1962(c)(d). See generally, CRS Report 96-950, RICO: A Brief Sketch.
237 18 U.S.C. 1963, 3571.
238 18 U.S.C. 1964.
239 See generally, Twenty-Sixth Survey of White Collar Crime: Money Laundering, 48 AMERICAN CRIMINAL LAW
REVIEW 929 (2011); CRS Report RL33315, Money Laundering: An Overview of 18 U.S.C. 1956 and Related Federal
Criminal Law
.
240 18 U.S.C. 1956 (text appended).
Congressional Research Service
48

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

• spending or depositing more than $10,000 of the proceeds of predicate
offenses.241
Offenses under the various paragraphs of 18 U.S.C. 1030 are all money laundering predicate
offenses,242 although paragraph 1030(a)(5) computer damage offenses are less likely to generate
proceeds than are the fraud and espionage offenses of paragraphs 1030(a)(4) and 1030(a)(1).
Computer Fraud (18 U.S.C. 1030(a)(4))
(a) Whoever ... (4) knowingly and with intent to defraud, accesses a protected computer
without authorization, or exceeds authorized access, and by means of such conduct furthers
the intended fraud and obtains anything of value, unless the object of the fraud and the thing
obtained consists only of the use of the computer and the value of such use is not more than
$5,000 in any 1-year period ... shall be punished as provided in subsection (c) of this section.
(b) Whoever attempts to commit an offense under subsection (a) of this section shall be
punished as provided in subsection (c) of this section.

Paragraph 1030(a)(4) outlaws fraud by computer intrusion. Its elements consist of
• knowingly and with intent to defraud;
• accessing a protected computer without authorization, or exceeding
authorization;
• thereby furthering a fraud and obtaining anything of value (other than a minimal
amount of computer time, i.e., more than $5,000 over the course of a year).243
Jurisdiction
Paragraph 1030(a)(4) outlaws fraud against “protected computers,” that is, computers used in or
affecting interstate or foreign commerce,244 those used by or for “the United States Government,”
or those used by or for a financial institution.245 The committee reports indicate that Congress
understood the phrase in the original legislation, “used in interstate or foreign commerce,” to be
the equivalent of “affecting interstate or foreign commerce.”246 When the Identity Theft
Enforcement and Restitution Act recast the jurisdictional base to expressly include computers

241 18 U.S.C. 1957.
242 18 U.S.C. 1956(c)(7)(D), 1957(f)(3).
243 Cenveo, Inc. v. Rao, 659 F.Supp.2d 312, 316 (D. Conn. 2009)( “To state a claim for relief under the plain words of
18 U.S.C. §1030(a)(4) Cenveo must plead factual content showing that (1) Ms. Rao accessed a protected computer
without authorization or in excess of her authorization; (2) she did so knowingly and with intent to defraud; (3) through
such access Ms. Rao both furthered her intended fraud and obtained something of value; and (4) Ms. Rao's conduct
caused Cenveo to suffer losses ‘aggregating at least $5,000 in value.’”); P.C. Yonkers, Inc. v. Celebrations the Party
and Seasonal Superstore, LLC
, 428 F.3d 504, 508 (3d Cir. 2005).
244 18 U.S.C. 1030(e)(2)(B); Multiven, Inc. v. Cisco Systems, Inc., 725 F.Supp.2d 887, 892 (N.D. Cal. July 20, 2010),
quoting United States v. Sutcliffe, 505 F.3d 944, 953 (9th Cir. 2007)(“[A]s both the means to engage in commerce and
the method by which transactions occur, the Internet is an instrumentality and channel of interstate commerce”).
245 18 U.S.C. 1030(e)(2)(A).
246 S.Rept. 104-357 at 10 (1996).
Congressional Research Service
49

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

“affecting” interstate or foreign commerce,247 it seemed to reinforce the committee’s expansive
understanding.
Congress further amended the definition of protected computer by adding the phrase “including a
computer located outside the United States that is used in a manner that affects interstate or
foreign commerce.”248 In doing so, it might be thought to have intended to preclude overseas
application of the paragraphs of subsection 1030(a) under any other circumstances, for example, a
federal computer located outside the United States that is not used in a manner that affects
commerce.
As noted earlier, there may be some real doubt whether the phrase “United States Government”
computers includes computers of the legislative and judicial branches or of the independent
federal agencies, or whether it encompasses only those within the executive branch. The
definition of protected computer in subparagraph 1030(e)(2)(B)(one used “in or affecting
interstate or foreign commerce or communication”) to which several of the section’s offenses are
anchored clearly anticipates expansive coverage. On the other hand, in paragraph 1030(a)(3),
Congress uses the phrase “Government of the United States” interchangeably with the more
expansive phrase “department or agency of the United States.” 249 Failure to follow suit in
paragraph (a)(4) might be considered more than inadvertent.
Unauthorized or Excessive Access
Thus far, the courts have been unable to agree on the meaning of “without authorization” or
“exceeds authorized access” as used in paragraph 1030(a)(4) and the other paragraphs of 18
U.S.C. 1030, even though the statute supplies a specific definition of the term “exceeds
authorized access.”250 Some have applied the terms to access by authorized employees who use
their access in any unauthorized manner or for unauthorized purposes and to outsiders who have
been granted access subject to explicit reservations.251 Others have concluded that “a person who
‘intentionally accesses a computer without authorization’ §§1030(a)(2) and (4), accesses a
computer without any permission at all, while a person who ‘exceeds authorized access,’ id., has

247 P.L. 110-326, 122 Stat. 3563 (2008).
248 18 U.S.C. 1030(e)(2).
249 18 U.S.C. 1030(a)(3)(emphasis added)(“Whoever . . . (3) intentionally, without authorization to access any
nonpublic computer of a department or agency of the United States, accesses such a computer of that department or
agency
that is exclusively for the use of the Government of the United States or, in the case of a computer not
exclusively for such use, is used by or for the Government of the United States and such conduct affects that use by or
for the Government of the United States. . . shall be punished as provided in subsection (c) of this section”). For
purposes of the federal criminal code, the term “Department” is defined to “describe the executive, legislative, or
judicial branches of the government” when context warrants, 18 U.S.C. 6.
250 18 U.S.C. 1030(e)(6)(“[T]he term ‘exceeds authorized access’ means to access a computer with authorization and to
use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter”).
251 United States v. John, 597 F.3d 263, 270-73 (5th Cir. 2010); YourNetDating v. Mitchell, 88 F. Supp. 2d 870, 872
(N.D. Ill. 2000) (former employee found to be exceeding authorized access because he used his access codes to divert
users from his ex-employer’s website); Shurgard Storage Centers v. Safeguard Self Storage, 119 F. Supp. 2d 1121
(W.D. Wash. 2000) (unauthorized access found when employees used their access to benefit a competitor); Southwest
Airlines Co. v. Farecase, Inc.
, 318 F.Supp.2d 435, 439-40 (N.D. Tex. 2004) (use of software to gather fare information
from airline’s website in spite of “no scraping” warnings constitutes a violation of paragraph 1030(a)(2)); Guest-Tek
Interactive Entertainment v. Pullen
, 665 F.Supp.2d 42, 44-46(D. Mass. 2009).
Congressional Research Service
50

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

permission to access the computer, but accesses information on the computer that the person is
not entitled to access.”252
Fraud and Intent
Paragraph 1030(a)(4) was proposed as part of the original statute in 1984,253 but only enacted
with the 1986 amendments.254 The reports accompanying the 1986 amendments note that the
intent element—“knowingly and with intent to defraud”—“is the same standard used for 18
U.S.C. 1029 relating to credit card fraud.”255 The phrase as used in the credit card fraud statute
means that the offender is conscious of the natural consequences of his action (i.e., that it is likely
that someone will be defrauded) and intends that those consequences should occur (i.e., he
intends that someone should be defrauded).256
The phrase “thereby furthers a fraud” insures that prosecutions are limited to cases where use of a
computer is central to a criminal scheme rather those where a computer is used simply as a
record-keeping convenience.257 Similarly, the demand that the value of converted property exceed
$5,000 minimizes the possibility that mere computer trespassing will be prosecuted as fraud.
The case law confirms the difficulty of maintaining a prosecution against even a repeated
trespasser under paragraph 1030(a)(4), as United States v. Czubinski, 106 F.3d 1069 (1st Cir.
1997), demonstrates. Czubinski involved an Internal Revenue Service employee who conducted a
number of unauthorized searches of taxpayer files in an IRS computer system. The Court of
Appeals overturned his conviction on four counts of violating paragraph 1030(a)(4) because it felt

252 LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1133 (9th Cir. 2009); Lewis-Burke Assoc. LLC, 725 F.Supp.2d 187,
192-94 (D.D.C. July 28, 2010); US Bioservices Corp. v. Lugo, 595 F.Supp.2d 1189, 1192 (D.Kan. 2009)(citing cases).
253 H.Rept. 98-894 at 27 (1984).
254 P.L. 99-474, 100 Stat. 1213 (1986), 18 U.S.C. 1030 (1986 Supp.).
255 S.Rept. 99-432 at 10 (1986); H.Rept. 99-612 at 12 (1986).
256 H.Rept. 98-894 at 16-7 (1984)(“A knowing state of mind with respect to an element of the offense is (1) an
awareness of the nature of one’s conduct, and (2) an awareness of or a firm belief in the existence of a relevant
circumstance such as whether an access device was counterfeit before it was used or trafficked in. The Committee
intends that the knowing state of mind requirement may be satisfied by proof that the actor was aware of a high
probability of the existence of the circumstances, although a defense should succeed if it is proven that the actor
actually believed that the circumstance did not exist after taking reasonable steps to warrant such belief.... The
Committee intends that the term ‘with the intent’ have the same culpable state of mind as the term ‘purpose’ as used in
the proposed Model Penal Code (§2.02). The distinction from a knowing state of mind was recently restated by Justice
Rehnquist, ‘... a person who causes a particular result is said to act purposefully if he consciously desires that result,
whatever the likelihood of that result happening from his conduct, while he is said to act knowingly if he is aware that
result is practically certain to follow from his conduct, whatever his desire may be as to that result.’ United States v.
Bailey
, 444 U.S. 394, 404 (1980)”).
257 S.Rept. 99-432 at 9 (1986)(“The Committee was concerned that computer usage that is wholly extraneous to an
intended fraud might nevertheless be covered by this subsection if the subsection were patterned directly after the
current mail fraud and wire fraud laws. If it were so patterned, the subsection might be construed as covering an
individual who had devised a scheme or artifice to defraud solely because used a computer to keep records or to add up
his potential ‘take’ from the crime. The Committee does not believe that a scheme or artifice to defraud should fall
under the ambit of subsection (a)(4) merely because the offender signed onto a computer at some point near to the
commission or execution of the fraud. While such a tenuous link might be covered under current law where the
instrumentality used is the mails or the wires, the Committee does not consider that link sufficient with respect to
computers. To be prosecuted under this subsection, the use of the computer must be more directly linked to the
intended fraud. That is, it must be used by the offender without authorization or in excess of his authorization to obtain
property of another, which property furthers in the intended fraud”).
Congressional Research Service
51

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

the government had failed to prove that the government had been defrauded, that is, deprived of
anything of value.258
Consequences
Violations are punishable by imprisonment for not more than five years (not more than 10 years
for subsequent offenses) and/or a fine of not more than $250,000 (not more than $500,000 for
organizations).259 The same sentencing guideline covers both fraud under paragraph 1030(a)(4),
and damage under paragraph 1030(a)(5), although the escalators based on the amount of loss
inflicted are likely to be more telling in the case of wide-spread damage caused by the release of a
worm or virus.260 The attempt, conspiracy, and complicity provisions apply to paragraph
1030(a)(4) offenses in much the same way as those provisions apply to the other paragraphs of
the section.261 Conviction of a paragraph 1030(a)(4) offense requires a victim restitution order and
may lead to the confiscation of the fruits and instrumentalities of the offense.262 Victims may sue
for compensatory damages and/or injunctive relief under subsection 1030(g).263
Other Crimes
Paragraph 1030(a)(4) prohibits unauthorized use of a government computer, a bank computer or a
computer used in interstate or foreign commerce as an integral part of a fraud. Its companions at
federal criminal law include general criminal statutes, statutes proscribing theft or fraud of federal
property, those that outlaw the theft or fraud of the property of financial institutions, and those
that prohibit theft or fraud involving property with an interstate or foreign commerce nexus.

258 “The plain language of Section 1030(a)(4) emphasizes that more than mere unauthorized use is required: the ‘thing
obtained’ may not merely be the unauthorized use. It is the showing of some additional end—to which the unauthorized
access is a means—that is lacking here. The evidence did not show that Czubinski’s end was anything more than to
satisfy his curiosity by viewing information about friends, acquaintances, and political rivals. No evidence suggests that
he printed out, recorded, or used the information he browsed. No rational jury could conclude beyond a reasonable
doubt that Czubinski intended to use or disclose that information, and merely viewing information cannot be deemed
the same as obtaining something of value for the purposes of this statute. [The district court, in denying a motion to
dismiss the computer fraud counts in the indictment, found that the indictment sufficiently alleged that the confidential
taxpayer information was itself a thing of value to Czubinski, given his ends. The indictment, or course, alleged
specific uses for the information, such as creating dossiers on KKK members, that were not proven at trial],” United
States v. Czubinski
, 106 F.3d at 1078 (portions of footnote 18 of the Court’s opinion in brackets). See also, United
States v. DeMonte
, 25 F.3d 343 (6th Cir. 1994)(authority of sentencing court to order probation instead of imprisonment
pursuant to a downward departure, on the basis of extraordinary circumstances, from the applicable sentencing
guidelines for a violation of 18 U.S.C. 1030(4) that occurred when the defendant, a Veterans’ Administration
supervisory accountant made fraudulent entries in a VA computer system that result in payments to a fictitious
company).
259 18 U.S.C. 1030(c)(4), 3571.
260 The governing Sentencing Guideline calculates the applicable sentencing ranges below the statutory 5 and 10 year
maximum penalties based on the amount of loss and the number of victims related to the offense, U.S.S.G. §2B1.1.
261 Conspiracy to violate paragraph 1030(a)(4) may also be charged under the general conspiracy statute, 18 U.S.C.
371, see e.g., United States v. Schaffer, 586 F.3d 414, 422 (6th Cir. 2009).
262 18 U.S.C. 981(a)(1)(C), 982(a)(2)(B), 1030(i), 1030(j), 3663A.
263 Civil plaintiffs utilizing 1030(g) tend to have been more likely to successfully litigate under a violation of
1030(a)(4) than in the criminal context. See, e.g., Creative Computing v. Getloaded.com, 386 F.3d 930 (9th Cir.
2004)(court found that plaintiff successfully demonstrated loss of business as economic damages, and that the evidence
supported a damage award and injunctive relief).
Congressional Research Service
52

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Interstate and Foreign Commerce
Wire Fraud. Although the wire fraud statute, 18 U.S.C. 1343, does not refer to “things of value,”
a phrase that encompasses both the tangible and the intangible, neither does it refer exclusively to
physical items such as “goods, wares, merchandises, securities or money.” Rather it condemns the
use of interstate or foreign wire communications pursuant to a scheme to defraud another of
“money or property.”264 The Supreme Court has made it clear that “property” within its purview
may include confidential information,265 and various federal courts have made it clear that
confidential information in computer storage is no less favored.266 In fact, one commentator
claims that “[t]he wire fraud statute, 18 U.S.C. 1343, has produced more convictions for
computer-related crimes than §1030 or any other computer-specific statute.”267
Credit Card Fraud. Section 1029 of Title 18 (credit card fraud) and Section 1030 (computer
fraud) share a common history.268 Like Section 1030, Section 1029 has undergone rather regular
fine-tuning since its initial passage in 1984 as part of the Comprehensive Crime Control Act of
that year.269 Unlike Section 1030, it has a single, uniformly applicable jurisdictional base: it
applies to offenses that “affect interstate or foreign commerce.”270

264 “Whoever, having devised or intending to devise any scheme or artifice to defraud, or for obtaining money or
property by means of false or fraudulent pretenses, representations, or promises, transmits or causes to be transmitted
by means of wire, radio, or television communication in interstate or foreign commerce, any writings, signs, signals,
pictures, or sounds for the purpose of executing such scheme or artifice, shall be fined under this title or imprisoned not
more than five years, or both. If the violation affects a financial institution, such person shall be fined not more than
$1,000,000 or imprisoned not more than 30 years, or both,” 18 U.S.C. 1343; see generally, Twenty-Sixth Survey of
White Collar Crime: Mail and Wire Fraud
, 48 AMERICAN CRIMINAL LAW REVIEW 905 (2011); Criminal and Civil
RICO: Traditional Canons of Statutory Interpretation and the Liberal Construction Clause
, 30 COLUMBIA JOURNAL OF
LAW & SOCIAL PROBLEMS 41 (1996); Lynch, RICO: The Crime of Being a Criminal, 87 COLUMBIA LAW REVIEW 661
(Pts. I & II), 920 (Pts. III & IV) (1987).
265 Carpenter v. United States, 484 U.S. 19, 26 (1987).
266 United States v. Martin, 228 F.3d 1, 16 (1st Cir. 2000); United States v. Czubinski, 106 F.3d 1069, 1073-76 (1st Cir.
1997); United States v. Wang, 898 F.Supp. 758, 760 (D.Colo. 1995); United States v. Seidlitz, 589 F.2d 152, 160 (4th
Cir. 1978).
267 Olivenbaum, <CTRL><ALT><DELETE>: Rethinking Federal Computer Crime Legislation, SETON HALL LAW
REVIEW 574, 625 (1997).
268 Each was enacted in part due to concerns about the breadth of a more narrowly crafted ancestor whose prohibitions
continue in effect. In the case of §1029, there were questions whether 15 U.S.C. 1644 (Truth in Lending Act) that
outlaws the fraudulent use of credit cards could reach counterfeiting or the use of stolen credit card account numbers,
H.Rept. 98-894, at 5 (1984). In the case of §1030, similar questions were raised about the sweep of 15 U.S.C. 1693n
(Electronic Funds Transfer Act) that outlaws the fraudulent use of bank debit cards), Id. See generally, What
Constitutes Violation of 18 USCS §1029, Prohibiting Fraud or Related Activity in Connection with Credit Card or
Other Credit Access Device
, 115 ALR FED 213.
269 P.L. 98-473, 98 Stat. 2183, 2190 (1984). §1029 was amended by P.L. 99-646, 100 Stat. 3601 (1986); P.L. 101-647,
104 Stat. 4831 (1990); P.L. 103-322, 108 Stat. 2087, 2148 (1994); P.L. 103-414, 108 Stat. 4291 (1994); P.L. 104-294,
110 Stat. 3501 (1996); P.L. 105-172, 112 Stat. 53 (1998); P.L. 107-25,115 Stat. 342 (2001); P.L. 107-273, 116 Stat.
1808 (2002).
270 The cases suggest that the interstate nexus must be clearly identifiable but have yet to identify the point, if any, at
which the connection becomes too tenuous to support a claim of an affect on interstate commerce, see e.g., United
States v. Bolton
, 68 F.3d 396, 400 n.3 (10th Cir. 1995)(large majority of stolen credit cards in the defendant’s
possession had out of state addresses printed on them); United States v. Clayton, 108 F.3d 1114, 1118 (9th Cir. 1997).
Since the misconduct proscribed is commercial in nature the question is not one of Congressional power but whether in
a given case the government can and has proven that the particular misconduct “affects interstate or foreign
commerce,” compare United States v. Morrison, 529 U.S. 598, 608-9 (2000) and United States v. Lopez, 514 U.S. 549,
558-59 (1995)(Congress may regulate the instrumentalities and use of the channels of interstate commerce and
activities that have a substantial relation to interstate commerce), with, Jones v. United States, 529 U.S. 848, 852
(continued...)
Congressional Research Service
53

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

The two overlap where Section 1029 outlaws the deception of commercial computer systems
through the improper use of an “access device” to acquire cash, credit, merchandise, or
services.271
An access device is (1) any
• card,
• personal identification number,
• plate,
• electronic serial number,
• code,
• mobile identification number, or
• any account number or other telecommunications service, equipment, or
instrument identifier, or other means of account access;
(2) that either
(a) can be used, alone or in conjunction with another access device, to obtain money,
goods, services, or any other thing of value, or
(b) can be used to initiate a transfer of funds (other than a transfer originated solely
by paper instrument).272
The level of intent for each of the several crimes established in Section 1029 is the same as that
often used for Section 1030—“knowing and with the intent to defraud.” Thus, criminal liability
under Section 1029 requires that the offender know that his or her actions are likely to deprive
another of something of value and demands that the offender means for that deprivation to
occur.273
Section 1029 establishes three types of crimes: misuse of access devices, conduct in anticipation
of misuse of access devices, and attempts or conspiracies to commit one of these substantive
violations. The misuse crimes include

(...continued)
(2000) (a statute that outlaws the destruction of property “used” in commerce does not protect residential property not
shown to have been used for any commercial purpose) and Gonzales v. Raich, 545 U.S. 1, 17 (2005) (Congress may
“regulate purely local activities that are part of an economic ‘class of activities’ that have a substantial effect on
interstate commerce”).
271 As discussed below §1029 also overlaps paragraph 1030(a)(6) that relates to trafficking in a particular access device,
computer passwords.
272 18 U.S.C. 1029(e)(1).
273 “‘With intent to defraud’ means that the offender has a conscious objective, desire or purpose to deceive another
person, and to induce such other person, in reliance upon such deception, to assume, create, transfer, alter or terminate
a right, obligation, or power with reference to property,” S.Rept. 368 at 7.
Congressional Research Service
54

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

• use of a counterfeit access device;274 a “counterfeit access device” is one that is
“counterfeit, fictitious, altered, or forged, or an identifiable component of an
access device or a counterfeit access device;”275
• use of an unauthorized access device resulting in a loss or gain over the course of
one year worth than $1,000;276 an “unauthorized access device” is one that has
been “lost, stolen, expired, revoked, canceled, or obtained with intent to
defraud;”277 and
• use of an access device “issued to another person” resulting in a loss or gain over
the course of one year worth $1,000 or more; again each of the uses is only
criminal if done knowingly and with an intent to defraud;278
The “preparation” offenses of Section 1029 each extend only to misconduct that affects interstate
or foreign commerce and only to misconduct committed knowingly and with an intent to
defraud.279 They include
• possession of 15 or more counterfeit or unauthorized access devices;280
• possession of “device-making” equipment (§1029(a)(4);281 essentially
counterfeiting paraphernalia;282
• offering another an access device or offering to sell information concerning an
access device, without the authorization of the issuer of the device;283

274 18 U.S.C. 1029(a)(1)(emphasis added)(“Whoever – (1) knowingly and with intent to defraud produces, uses, or
traffics in one or more counterfeit access devices ... shall, if the offense affects interstate or foreign commerce, be
punished as provided in subsection (c) of this section”).
275 18 U.S.C. 1029(e)(2). “The term ‘fictitious’ is intended to cover a number of different types of counterfeit devices,
including representations, depictions or facsimiles of an access device. The definition is intended to be sufficiently
broad to cover components of an access device or a counterfeit access device, but would exclude indistinguishable raw
materials. The components would include elements of devices that are legitimate but obtained or used with an intent to
defraud. Thus, any identifiable component, whether it is in fact an actual component that has been obtained in some
fashion by a perpetrator with an intent to defraud or a false or counterfeit substitute for a legitimate component, would
fall within the definition of counterfeit access device. The committee intends the term ‘component’ to include
incomplete access devices or counterfeit access devices, such as any mag strips, holograms, signature panels,
microchips, and blank cards of so-called ‘white plastic.’” H.Rept. 98-894 at 19 (1984).
276 18 U.S.C. 1029(a)(2)(emphasis added)(“Whoever ... knowingly and with intent to defraud traffics in or uses one or
more unauthorized access devices during any one-year period, and by such conduct obtains anything of value
aggregating $1,000 or more during that period ... shall, if the offense affects interstate or foreign commerce, be
punished as provided in subsection (c) of this section”).
277 18 U.S.C. 1029(e)(3).
278 18 U.S.C. 1029(a)(5)(“Whoever ... knowingly and with intent to defraud effects transactions, with 1 or more access
devices issued to another person or persons, to receive payment or any other thing of value during any 1-year period the
aggregate value of which is equal to or greater than $1,000 ... shall, if the offense affects interstate or foreign
commerce, be punished as provided in subsection (c) of this section”).
279 18 U.S.C. 1029(a).
280 “Whoever ... knowingly and with intent to defraud possesses fifteen or more devices which are counterfeit or
unauthorized access devices ... shall, if the offense affects interstate or foreign commerce, be punished as provided in
subsection (c) of this section,” 18 U.S.C. 1029(a)(3).
281 “Whoever ... knowingly, and with intent to defraud, produces, traffics in, has control or custody of, or possesses
device-making equipment ... shall, if the offense affects interstate or foreign commerce, be punished as provided in
subsection (c) of this section,” 18 U.S.C. 1029(a)(4).
282 “As used in this section ... the term ‘device-making equipment’ means any equipment, mechanism, or impression
designed or primarily used for making an access device or a counterfeit access device,” 18 U.S.C. 1029(e)(6).
Congressional Research Service
55

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

• use of a telecommunications device modified or altered to permit the
unauthorized receipt of telecommunications services;284
• use of a scanner;285 that is, illegal wiretapping or electronic eavesdropping
equipment;286
• possession of computer equipment used to avoid telecommunications charges,
that is, possession of “hardware or software used for altering or modifying
telecommunications instruments to obtain unauthorized access to
telecommunications services”;287 and
• causing another to present credit card slips for payment with the intent to
defraud.288
Paragraph 1029(b)(1) makes it a separate offense to attempt to commit any of the substantive
crimes in subsection 1029(a) just described.289 Paragraph 1029(b)(2) makes it a separate offense
to conspire to commit any of them.290 Attempt carries the same penalties as the completed offense
(imprisonment either for not more than 10 or not more than 15 years), but conspiracy is
punishable by imprisonment for not more than half the maximum terms applicable to the

(...continued)
283 “Whoever ... without the authorization of the issuer of the access device, knowingly and with intent to defraud
solicits a person for the purpose of – (A) offering an access device; or (B) selling information regarding or an
application to obtain an access device ... shall, if the offense affects interstate or foreign commerce, be punished as
provided in subsection (c) of this section,” 18 U.S.C. 1029(a)(6).
284 “Whoever ... knowingly and with intent to defraud uses, produces, traffics in, has control or custody of, or possesses
a telecommunications instrument that has been modified or altered to obtain unauthorized use of telecommunications
services ... shall, if the offense affects interstate or foreign commerce, be punished as provided in subsection (c) of this
section,” 18 U.S.C. 1029(a)(7).
285 “Whoever ... knowingly and with intent to defraud uses, produces, traffics in, has control or custody of, or possesses
a scanning receiver ... shall, if the offense affects interstate or foreign commerce, be punished as provided in subsection
(c) of this section,” 18 U.S.C. 1029(a)(8).
286 “The term ‘scanning receiver’ means a device or apparatus that can be used to intercept a wire or electronic
communication in violation of chapter 119 or to intercept an electronic serial number, mobile identification number, or
other identifier of any telecommunications service, equipment, or instrument,” 18 U.S.C. 1029(e)(8).
287 “Whoever ... knowingly and with intent to defraud uses, produces, traffics in, has control or custody of, or possesses
hardware or software, knowing it has been configured to insert or modify telecommunication identifying information
associated with or contained in a telecommunications instrument so that the instrument may be used to obtain
telecommunications service without authorization ... shall, if the offense affects interstate or foreign commerce, be
punished as provided in subsection (c) of this section,” 18 U.S.C. 1029(a)(9).
288 “Whoever ... without the authorization of the credit card system member* or its agent, knowingly and with intent to
defraud causes or arranges for another person to present to the member or its agent, for payment, 1 or more evidences
or records of transactions made by an access device; shall, if the offense affects interstate or foreign commerce, be
punished as provided in subsection (c) of this section,” 18 U.S.C. 1029(a)(10).
* “As used in this section ... [t]he term ‘credit card system member’ means a financial institution or other entity that is a
member of a credit card system, including an entity, whether affiliated with or identical to the credit card issuer, that is
the sole member of a credit card system,” 18 U.S.C. 1029(e)(7).
289 “Whoever attempts to commit an offense under subsection (a) of this section shall be punished as provided in
subsection (c) of this section,” 18 U.S.C. 1029(b)(1).
290 “Whoever is a party to a conspiracy of two or more persons to commit an offense under subsection (a) of this
section, if any of the parties engages in any conduct in furtherance of such offense, shall be fined an amount not greater
than the amount provided as the maximum fine for such offense under subsection (c) of this section or imprisoned not
longer than one-half the period provided as the maximum imprisonment for such offense under subsection (c) of this
section, or both,” 18 U.S.C. 1029(b)(2).
Congressional Research Service
56

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

underlying offense (imprisonment for not more than 5 or not more than 7.5 years).291 One reason
for the distinction may be that while attempt is merged in the completed offense so that an
offender may be punished for either but not both, the crime of conspiracy is ordinarily not merged
in the substantive offense so that punishment for either or both is permitted.
In any event, the maximum penalties are determined by those set for the underlying violations of
subsection 1029: (1) imprisonment for not more than 10 years for first time offenses involving
• use of counterfeit access devices;292
• use of unauthorized access devices;293
• possession of 15 or more counterfeit or unauthorized access devices;294
• unauthorized sale of an access device;295
• possession of a device designed to avoid telephone charges;296 or
• fraudulently causing another to present credit card slips for payment;297
and (2) imprisonment for not more than 15 years for first time offenses involving
• possession of counterfeiting equipment;298
• use of another’s access device to defraud;299
• possession of a scanner;300 or
• possession of equipment designed to avoid communications service charges.301

291 18 U.S.C. 1029(b).
292 18 U.S.C. 1029(a)(1).
293 18 U.S.C. 1029(a)(2).
294 18 U.S.C. 1029(a)(3).
295 18 U.S.C. 1029(a)(6).
296 18 U.S.C. 1029(a)(7).
297 18 U.S.C. 1029(a)(10).
298 18 U.S.C. 1029(a)(4).
299 18 U.S.C. 1029(a)(5).
300 18 U.S.C. 1029(a)(8).
301 18 U.S.C. 1029(a)(9). Offenders are subject to fines and forfeiture as well, “(1) ...The punishment for an offense
under subsection (a) of this section is – (A) in the case of an offense that does not occur after a conviction for another
offense under this section – (i) if the offense is under paragraph (1), (2), (3), (6), (7), or (10) of subsection (a), a fine
under this title or imprisonment for not more than 10 years, or both; and (ii) if the offense is under paragraph (4), (5),
(8), or (9), of subsection (a), a fine under this title or imprisonment for not more than 15 years, or both; (B) in the case
of an offense that occurs after a conviction for another offense under this section, a fine under this title or imprisonment
for not more than 20 years, or both; and (C) in either case, forfeiture to the United States of any personal property used
or intended to be used to commit the offense.
“(2) Forfeiture procedure.BThe forfeiture of property under this section, including any seizure and disposition of the
property and any related administrative and judicial proceeding, shall be governed by section 413 of the Controlled
Substances Act, except for subsection (d) of that section,” 18 U.S.C. 1029(c).
Congressional Research Service
57

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Defrauding the Federal Government
Conspiracy. The same statute that makes it a crime to conspire to violate federal law also makes it
a federal crime to conspire to defraud the United States, 18 U.S.C. 371.302 Unlike the mail and
wire fraud statutes, a successful prosecution for conspiracy to defraud the United States does not
require a showing that the defendant sought to deprive the United States or anyone else of money
or property.303 This lesser known branch of the statute has extraordinary range and “reaches any
conspiracy for the purpose of impairing, obstructing or defeating the lawful function of any
department of the Government.”304 There need be no evidence of any other underlying
substantive offense or purpose.305 “The government need only show (1) that the defendant entered
into an agreement (2) to obstruct a lawful function of the government (3) by deceitful or dishonest
means and (4) at least one overt act in furtherance of the conspiracy.”306
Fraud Involving Government Computers. There are also a host of federal criminal statutes that
proscribe fraud in one form or other, more than a few of which would cover the unauthorized
manipulation of federal computers as an integral part of a scheme to defraud. Two of the more
prominent, the false statement statute, 18 U.S.C. 1001 (false statements on a matter within the
jurisdiction of a federal agency or department) and conspiracy to defraud the United States, 18
U.S.C. 371, have already been mentioned. Others include 18 U.S.C. 1031 (major procurement
fraud against the United States);307 18 U.S.C. 1035 (false statements relating to health care);308 18

302 “If two or more persons conspire ... to defraud the United States, or any agency thereof in any manner or for any
purpose, and one or more of such persons do any act to effect the object of the conspiracy, each shall be fined under
this title or imprisoned not more than five years, or both,” 18 U.S.C. 371.
303 United States v. Goldberg, 105 F.3d 770, 773 (1st Cir. 1997); United States v. Clark, 139 F.3d 485, 488-89 (5th Cir.
1998); United States v. Gosselin World Wide Moving, 411F.3d 502, 516 (4th Cir. 2005); United States v. Shellef, 507
F.3d 82, 104 (2d Cir. 2007).
304 Tanner v. United States, 483 U.S. 107, 128 (1987), citing, Dennis v. United States, 384 U.S. 855, 861 (1966); Hass
v. Henkel
, 216 U.S. 462, 479 (1910); Glasser v. United States, 315 U.S. 60, 66 (1942); Hammerschmidt v. United
States
, 265 U.S. 182, 188 (1924); Gosselin World Wide Moving, 411 F.3d 502, 516 (4th Cir.2005); United States v.
McKee
, 506 F.3d 225, 238 (3d Cir. 2007).
305 United States v. Ballistrea, 101 F.3d 827, 832 (2d Cir. 1996)(“So long as deceitful or dishonest means are employed
to obstruct governmental functions, the impairment need not involve the violation of a separate statute”); United States
v. Khalife
, 106 F.3d 1300, 1303 (6th Cir. 1997); United States v. Douglas, 398 F.3d 407, 412 (6th Cir. 2005)(“a
conviction under section 371 does not require the government to prove a violation of a separate substantive statute”).
306 United States v. Shellef, 507 F.3d 82, 107 (2d Cir. 2007); United States v. Dean, 55 F.3d 640, 647 (D.C.Cir. 1994);
United States v. Hansen, 262 F.3d 1217, 1246 (11th Cir. 2001)(“To obtain a conviction under 18 U.S.C. §371, the
government must show: (1) the existence of an agreement to achieve an unlawful objective; (2) the defendant’s
knowing and voluntary participation in the conspiracy; and (3) the commission of an overt act in furtherance of the
conspiracy”).
307 “(a) Whoever knowingly executes, or attempts to execute, any scheme or artifice with the intent – (1) to defraud the
United States; or (2) to obtain money or property by means of false or fraudulent pretenses, representations, or
promises – in any procurement of property or services as a prime contractor with the United States or as a subcontractor
or supplier on a contract in which there is a prime contract with the United States, if the value of the contract,
subcontract, or any constituent part thereof, for such property or services is $1,000,000 or more shall, subject to the
applicability of subsection (c) of this section, be fined not more than $1,000,000, or imprisoned not more than 10 years,
or both.
“(b) The fine imposed for an offense under this section may exceed the maximum otherwise provided by law, if such
fine does not exceed $5,000,000 and – (1) the gross loss to the Government or the gross gain to a defendant is $500,000
or greater; or (2) the offense involves a conscious or reckless risk of serious personal injury.
“(c) The maximum fine imposed upon a defendant for a prosecution including a prosecution with multiple counts under
this section shall not exceed $10,000,000....” 18 U.S.C. 1031.
308 “Whoever, in any matter involving a health care benefit program, knowingly and willfully—(1) falsifies, conceals,
(continued...)
Congressional Research Service
58

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

U.S.C. 1014 (false statements on federally insured loan and credit applications);309 18 U.S.C.
1010, 1012 (false statements concerning various HUD transactions);310 and 18 U.S.C. 287 (false
claims against the United States).311
Bank Fraud
Although less numerous, several federal criminal statutes outlaw defrauding financial institutions
in language similar to the prohibitions against defrauding the United States, most notably the

(...continued)
or covers up by any trick, scheme, or device a material fact; or (2) makes any materially false, fictitious, or fraudulent
statements or representations, or makes or uses any materially false writing or document knowing the same to contain
any materially false, fictitious, or fraudulent statement or entry, in connection with the delivery of or payment for
health care benefits, items, or services, shall be fined under this title or imprisoned not more than five years, or both,”
18 U.S.C. 1035(a).
309 “Whoever knowingly makes any false statement or report, or willfully overvalues any land, property or security, for
the purpose of influencing in any way the action of the Farm Credit Administration, Federal Crop Insurance
Corporation or a company the Corporation reinsures, the Secretary of Agriculture acting through the Farmers Home
Administration or successor agency, the Rural Development Administration or successor agency, any Farm Credit
Bank, production credit association, agricultural credit association, bank for cooperatives, or any division, officer, or
employee thereof, or of any regional agricultural credit corporation established pursuant to law, or a Federal land bank,
a Federal land bank association, a Federal Reserve bank, a small business investment company, as defined in Section
103 of the Small Business Investment Act of 1958 (15 U.S.C. 662), or the Small Business Administration in connection
with any provisions of that act, a Federal credit union, an insured State-chartered credit union, any institution the
accounts of which are insured by the Federal Deposit Insurance Corporation, the Office of Thrift Supervision, any
Federal home loan bank, the Federal Housing Finance Board, the Federal Deposit Insurance Corporation, the
Resolution Trust Corporation, the Farm Credit System Insurance Corporation, or the National Credit Union
Administration Board, a branch or agency of a foreign bank (as such terms are defined in paragraphs (1) and (3) of
Section 1(b) of the International Banking Act of 1978), or an organization operating under section 25 or section 25(a)
of the Federal Reserve Act, upon any application, advance, discount, purchase, purchase agreement, repurchase
agreement, commitment, or loan, or any change or extension of any of the same, by renewal, deferment of action or
otherwise, or the acceptance, release, or substitution of security therefor, shall be fined not more than $1,000,000 or
imprisoned not more than 30 years, or both....” 18 U.S.C. 1014.
310 “Whoever, for the purpose of obtaining any loan or advance of credit from any person, partnership, association, or
corporation with the intent that such loan or advance of credit shall be offered to or accepted by the Department of
Housing and Urban Development for insurance, or for the purpose of obtaining any extension or renewal of any loan,
advance of credit, or mortgage insured by such Department, or the acceptance, release, or substitution of any security
on such a loan, advance of credit, or for the purpose of influencing in any way the action of such Department, makes,
passes, utters, or publishes any statement, knowing the same to be false, or alters, forges, or counterfeits any
instrument, paper, or document, or utters, publishes, or passes as true any instrument, paper, or document, knowing it to
have been altered, forged, or counterfeited, or willfully overvalues any security, asset, or income, shall be fined under
this title or imprisoned not more than two years, or both,” 18 U.S.C. 1010.
“Whoever, with intent to defraud, makes any false entry in any book of the Department of Housing and Urban
Development or makes any false report or statement to or for such Department; or whoever receives any compensation,
rebate, or reward, with intent to defraud such Department or with intent unlawfully to defeat its purposes; or whoever
induces or influences such Department to purchase or acquire any property or to enter into any contract and willfully
fails to disclose any interest which he has in such property or in the property to which such contract relates, or any
special benefit which he expects to receive as a result of such contract—shall be fined under this title or imprisoned not
more than one year, or both,” 18 U.S.C. 1012.
311 “Whoever makes or presents to any person or officer in the civil, military, or naval service of the United States, or to
any department or agency thereof, any claim upon or against the United States, or any department or agency thereof,
knowing such claim to be false, fictitious, or fraudulent, shall be imprisoned not more than five years and shall be
subject to a fine in the amount provided in this title,” 18 U.S.C. 287; see generally, Twenty-Sixth Survey of White
Collar Crime: False Statements and False Claims
, 48 AMERICAN CRIMINAL LAW REVIEW 629 (2011).
Congressional Research Service
59

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

general bank fraud provision, 18 U.S.C. 1344312 and the laws that proscribe embezzlement and
similar misconduct by bank officers and employees.313
General Crimes
CAN-SPAM Act. The most likely overlap may be with the CAN-SPAM Act of 2003, 18 U.S.C.
1037. The CAN-SPAM Act offers protection to all “protected computers.”314 The criminal
provisions of the Controlling the Assault of Non-Solicited Pornography and Marketing Act of
2003 (CAN-SPAM) generally broaden the type of coverage provided by the 1030 paragraphs and
add to the federal government’s ability to prosecute hackers who use e-mail for fraudulent
purposes. More precisely, Section 1037 proscribes, when done knowingly and in a manner in or
affecting interstate or foreign commerce,
• accessing a protected computer and intentionally sending multiple e-mails
(multiple means more than 100 a day month, 1,000 a month, or 10,000 a year);315
• using a protected computer to send commercial e-mails with the intent to deceive
or mislead as to their source;316
• materially altering an e-mail header and sending out multiple e-mails under the
falsified header; 317
• registering for 5 or more e-mail accounts or 2 or domain names providing false
identification and using them to send out multiple commercial e-mails;318 or
• providing false identification to registrant of 5 or more IP addresses and using the
addresses to send out multiple commercial e-mails, or conspires to do so.319

312 “Whoever knowingly executes, or attempts to execute, a scheme or artifice—(1) to defraud a financial institution; or
(2) to obtain any of the moneys, funds, credits, assets, securities, or other property owned by, or under the custody or
control of, a financial institution, by means of false or fraudulent pretenses, representations, or promises—shall be fined
not more than $1,000,000 or imprisoned not more than 30 years, or both,” 18 U.S.C. 1344; see generally, Twenty-Sixth
Survey of White Collar Crime: Financial Institution Fraud
, 48 AMERICAN CRIMINAL LAW REVIEW 697 (2011).
313“Whoever, being an officer, director, agent or employee of, or connected in any capacity with any Federal Reserve
bank, member bank, depository institution holding company, national bank, insured bank, branch or agency of a
foreign bank, or organization operating under section 25 or section 25(a) of the Federal Reserve Act [12 U.S.C.A. ss
601 et seq., 611 et seq.], or a receiver of a national bank, insured bank, branch, agency, or organization or any agent or
employee of the receiver, or a Federal Reserve Agent, or an agent or employee of a Federal Reserve Agent or of the
Board of Governors of the Federal Reserve System, embezzles, abstracts, purloins or willfully misapplies any of the
moneys, funds or credits of such bank, branch, agency, or organization or holding company or any moneys, funds,
assets or securities intrusted to the custody or care of such bank, branch, agency, or organization, or holding company
or to the custody or care of any such agent, officer, director, employee or receiver, shall be fined not more than
$1,000,000 or imprisoned not more than 30 years, or both; but if the amount embezzled, abstracted, purloined or
misapplied does not exceed $1,000, he shall be fined under this title or imprisoned not more than one year, or both,” 18
U.S.C. 656; see also, 18 U.S.C. 657 (theft or embezzlement by officer or employee of lending, credit or insurance
institution); 1005 (false entries by bank officers or employees); 1006 (false entries by officers or employees of federal
credit institutions); 1007 (false statements to influence the Federal Deposit Insurance Corporation).
314 The definition of “protected computer” in §1037 defers to the definition in 1030(e)(2(B), which covers any
computer “used in interstate or foreign commerce or communication” and implicates any computer connected to the
Internet.
315 18 U.S.C. 1037(a)(1), (d)(3).
316 18 U.S.C. 1037(a)(2).
317 18 U.S.C. 1037(a)(3), (d)(3).
318 18 U.S.C. 1037(a)(4), (d)(3).
Congressional Research Service
60

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Offenders face one of a number of sentences ranging from imprisonment for not more than a year
to imprisonment for not more than 5 years depending on the extent and regularity of the offense,
among other factors.320 When the offense is punishable by imprisonment for not more than a year,
offenders also face to a fine of not more than $100,000 (not more than $200,000 for
organizations); those guilty of other violations of Section 1037 face fines of not more than
$250,000 (not more than $500,000 for organizations).321 Any property used in, or realized
through, the commission of the offense is subject to confiscation.322
Money Laundering. The principal federal money laundering statutes, 18 U.S.C. 1956 and 1957,
outlaw various financial activities that involve the proceeds from other federal crimes. They
prohibit
• domestic laundering the proceeds of these predicate offenses, referred to as
“specified unlawful activities;”
• international laundering the proceeds of predicate offenses;
• using the proceeds of predicate offenses to promote further predicate offenses;323
or
• spending or depositing more than $10,000 of the proceeds of predicate
offenses.324
Offenses under the various paragraphs of 18 U.S.C. 1030 are all money laundering predicate
offenses.325 Directly or indirectly they will support a money laundering prosecution as will
several of the crimes that may be implicated whenever a paragraph 1030(a)(4) fraud offense is
involved: that is, credit card fraud (18 U.S.C. 1029), and wire fraud (18 U.S.C. 1343).

(...continued)
319 18 U.S.C. 1037(a)(5), (d)(3).
320 “The punishment for an offense under subsection (a) is—(1) a fine under this title, imprisonment for not more than 5
years, or both, if—(A) the offense is committed in furtherance of any felony under the laws of the United States or of
any State; or (B) the defendant has previously been convicted under this section or Section 1030, or under the law of
any State for conduct involving the transmission of multiple commercial electronic mail messages or unauthorized
access to a computer system;
“(2) a fine under this title, imprisonment for not more than 3 years, or both, if—(A) the offense is an offense under
subsection (a)(1); (B) the offense is an offense under subsection (a)(4) and involved 20 or more falsified electronic mail
or online user account registrations, or 10 or more falsified domain name registrations; (C) the volume of electronic
mail messages transmitted in furtherance of the offense exceeded 2,500 during any 24-hour period, 25,000 during any
30-day period, or 250,000 during any 1-year period; (D) the offense caused loss to one or more persons aggregating
$5,000 or more in value during any 1-year period; (E) as a result of the offense any individual committing the offense
obtained anything of value aggregating $5,000 or more during any 1-year period; or (F) the offense was undertaken by
the defendant in concert with three or more other persons with respect to whom the defendant occupied a position of
organizer or leader; and
“(3) a fine under this title or imprisonment for not more than 1 year, or both, in any other case,” 18 U.S.C. 1037(b).
321 18 U.S.C. 3571.
322 18 U.S.C. 1037(c).
323 18 U.S.C. 1956 (text appended).
324 18 U.S.C. 1957.
325 18 U.S.C. 1956(c)(7)(D), 1957(f)(3).
Congressional Research Service
61

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Financial transactions are defined broadly for money laundering purposes to encompass virtually
every possible transfer of wealth,326 as long as they “in any way or degree affect[] interstate or
foreign commerce ... or ... involving the use of a financial institution which is engaged in, or the
activities of which affect, interstate or foreign commerce in any way or degree.”327 The proof
required to satisfy this “any way or degree” jurisdictional element, has been characterized as “de
minimis,” “minimal,” “slight,” or “incidental,” even after the Supreme Court pointed out that
Congress’s legislative authority under the commerce clause is not boundless.328
To establish “promotion” the government need show little more than that the transaction is
intended to further the illicit scheme, activity or business.329
“The elements necessary to prove a violation of §1957 are that:
(1) the defendant engage or attempt to engage
(2) in a monetary transaction
(3) in criminally derived property that is of a value greater than $10,000
(4) knowing that the property is derived from unlawful activity, and

326 “(4) the term ‘financial transaction’ means (A) a transaction* which in any way or degree affects interstate or
foreign commerce (i) involving the movement of funds by wire or other means or (ii) involving one or more monetary
instruments, ** or (iii) involving the transfer of title to any real property, vehicle, vessel, or aircraft, or (B) a transaction
involving the use of a financial institution which is engaged in, or the activities of which affect, interstate or foreign
commerce in any way or degree,” 18 U.S.C. 1956(c)(4).
* “The term ‘transaction’ includes a purchase, sale, loan, pledge, gift, transfer, delivery, or other disposition, and with
respect to a financial institution includes a deposit, withdrawal, transfer between accounts, exchange of currency, loan,
extension of credit, purchase or sale of any stock, bond, certificate of deposit, or other monetary instrument, use of a
safe deposit box, or any other payment, transfer, or delivery by, through, or to a financial institution, by whatever
means effected,” 18 U.S.C. 1956(c)(3).
** “The term ‘monetary instruments’ means (i) coin or currency of the United States or of any other country, travelers’
checks, personal checks, bank checks, and money orders, or (ii) investment securities or negotiable instruments, in
bearer form or otherwise in such form that title thereto passes upon delivery,” 18 U.S.C. 1956(c)(5).
327 18 U.S.C. 1956(c)(4).
328 United States v. Ables, 167 F.3d 1021, 1029 (6th Cir. 1999); United States v. Owens, 167 F.3d 739, 755 (1st Cir.
1999); United States v. Meshack, 225 F.3d 556, 572 (5th Cir. 2000); United States v. Oliveros, 275 F.3d 1299, 1303
(11th Cir. 2001); United States v. Gotti, 459 F.3d 296, 336 (2d Cir. 2006). In United States v. Lopez, 514 U.S. 549
(1995), the United States Supreme Court held that Gun Free School Zone Act, which purported to make it a federal
crime to possess a gun in or near a school, failed to claim or exhibit the nexus to interstate or foreign commerce
necessary to constitute the valid exercise of Congress’s legislative authority under the Constitution’s commerce clause;
see also, United States v. Morrison, 529 U.S. 598 (2000); United States v. Comstock, 130 S.Ct. 1949 (2010).
329 United States v. Williamson, 339 F.3d 1295, 1302 (11th Cir. 2003) (depositing and cashing checks of proceeds of
fraud promoted present and future unlawful activities); United States v. Rivera, 295 F.3d 461, 469 (5th Cir. 2002)(bank
withdrawal of a portion of the proceeds of a fraudulent scheme to pay a co-conspirator his share constituted
“promotion”); see also, United States v. Febus, 218 F.3d 784, 790 (7th Cir. 1999) (operator of illegal gambling
enterprise “promoted” the venture for money laundering purposes by paying off winning customers and thereby
ensuring their continued patronage); United States v. Meshack, 225 F.3d 556, 573 (5th Cir. 2000)(defendant’s use of
drug money to pay the rent on his girlfriend’s apartment where drugs were stored and which was used “in an attempt to
conceal the conspiracy” was sufficient to establish promotion of the drug trafficking conspiracy); United States v.
Bockius
, 228 F.3d 305, 310 n.8 (3d Cir. 2000)(noting its holding in United States v. Paramo, 998 F.2d 1212, 1218 (3d
Cir. 1993) (that a rational jury could have concluded that cashing embezzled IRS checks was intended to promote the
antecedent frauds).
Congressional Research Service
62

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

(5) the property is, in fact, derived from ‘specified unlawful activity.’”330
The predicate offenses are the same as those for Section 1956,331 the meaning of “monetary
transaction” closely tracks that of a “financial transaction” in Section 1956,332 and the definition
of monetary transaction includes the jurisdiction component of the offense, that is, that the
transaction occurs “in or affecting interstate or foreign commerce,”333 which requires no more
than the de minimis nexus demanded of Section 1956.334
State Computer Fraud Law. Although the elements vary considerably, most states have explicit
statutory prohibitions against computer fraud.335

330 United States v. Sokolow, 91 F.3d 396, 408 (3d Cir. 1996); United States v. Rivera-Hernandez, 497 F3d 71,76 (1st
Cir. 2007); United States v. Rayborn, 491 F.3d 513, 517 (6th Cir. 2007).
Or more precisely, “(a) Whoever, in any of the circumstances set forth in subsection (d), knowingly engages or
attempts to engage in a monetary transaction in criminally derived property that is of a value greater than $10,000 and
is derived from specified unlawful activity, shall be punished as provided in subsection (b).
“(b)(1) Except as provided in paragraph (2), the punishment for an offense under this section is a fine under title 18,
United States Code, or imprisonment for not more than ten years or both. (2) The court may impose an alternate fine to
that imposable under paragraph (1) of not more than twice the amount of the criminally derived property involved in
the transaction.
“(c) In a prosecution for an offense under this section, the Government is not required to prove the defendant knew
that the offense from which the criminally derived property was derived was specified unlawful activity.
“(d) The circumstances referred to in subsection (a) are – (1) that the offense under this section takes place in the
United States or in the special maritime and territorial jurisdiction of the United States; or (2) that the offense under this
section takes place outside the United States and such special jurisdiction, but the defendant is a United States person
(as defined in section 3077 of this title, but excluding the class described in paragraph (2)(D) of such section) ... ” 18
U.S.C. 1957(a)-(d).
331 18 U.S.C. 1957(f)(3).
332 “As used in this section – (1) the term ‘monetary transaction’ means the deposit, withdrawal, transfer, or exchange,
in or affecting interstate or foreign commerce, of funds or a monetary instrument (as defined in Section 1956(c)(5) of
this title) by, through, or to a financial institution (as defined in Section 1956 of this title), including any transaction
that would be a financial transaction under Section 1956(c)(4)(B) of this title, but such term does not include any
transaction necessary to preserve a person’s right to representation as guaranteed by the sixth amendment to the
Constitution,” 18 U.S.C. 1957(f)(1).
333 18 U.S.C. 1957(f)(1).
334 United States v. Aramony, 88 F.3d 1369, 1386 (4th Cir. 1996); United States v. Kunzman, 54 F.3d 1522, 1527 (10th
Cir. 1995); it is enough, for example, for the government to show that the transaction involved a federally insured bank,
United States v. Benjamin, 252 F.3d 1, 8 (1st Cir. 2001); United States v. Ford, 184 F.3d 566, 583-84 (6th Cir. 1999);
United States v. Wadena, 152 F.3d 831, 853 (8th Cir. 1998).
335 ALASKA STAT. §11.46.740; ARIZ.REV. STAT.ANN. §13-2316; ARK.CODE ANN. §5-41-103; CAL.PENAL CODE §502;
COLO.REV. STAT.ANN. §18-5.5-102; FLA.STAT. ANN. §815.06; GA.CODE ANN. §16-9-93, 93.1; HAWAII REV.STAT.
§708-891, 891.5; IDAHO CODE §18-2202; ILL. COMP.STAT.ANN. ch. 720 §5/16D-5; IOWA CODE ANN. §715.4; KAN.
STAT.ANN. §21-3755; KY.REV.STAT. ANN. §434.845; LA. REV.STAT.ANN. §14:73.5; MICH.COMP.LAWS ANN. §752.794;
MISS. CODE ANN. §97-45-3; MONT.CODE ANN. §45-6-311; NEB.REV.STAT. §28-1344; NEV.REV. STAT. §§205.4765,
481; N.H.REV.STAT.ANN. §§638:17, 638.18; N.J.STAT.ANN. §2C:20-25; N.MEX.STAT.ANN. §30-45-3; N.C.GEN.STAT.
§§14-454, 14-454.1, 14-458; N.D. CENT.CODE §12.1-06.1-08; OHIO REV. CODE ANN. §2913.04; OKLA.STAT.ANN. tit.21
§1953; ORE.REV.STAT. §164.377; PA.STAT.ANN. tit.18 §§7611, 7613; R.I.GEN.LAWS §11-52-2; S.C. CODE ANN. §16-
16-20; TENN.CODE ANN. §39-14-602; TEX.PENAL CODE ANN. §33.02; UTAH CODE ANN. §76-10-1801; VT.STAT.ANN.
tit.13 §4103; VA.CODE §18.2-152.3; WASH. REV.CODE ANN. §9A.52.110; W.VA.CODE ANN. §61-3C-4; WIS.STAT.ANN.
§943.70; WYO.STAT. §6-3-502.
Congressional Research Service
63

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Extortionate Threats (18 U.S.C. 1030(a)(7))
(a) Whoever ... (7) with intent to extort from any person any money or other thing of value,
transmits in interstate or foreign commerce any communication containing any
B
(A) threat to cause damage to a protected computer;
(B) threat to obtain information from a protected computer without authorization or in
excess of authorization or to impair the confidentiality of information obtained from a
protected computer without authorization or by exceeding authorized access; or
(C) demand or request for money or other thing of value in relation to damage to a
protected computer, where such damage was caused to facilitate the extortion;

shall be punished as provided in subsection (c) of this section.
(b) Whoever attempts to commit an offense under subsection (a) of this section shall be
punished as provided in subsection (c) of this section.

Congress enacted subparagraph 1030(a)(7)(A) in 1996 out of concern that “the ‘property’
protected under existing laws, such as the Hobbs Act, 18 U.S.C. 1951 (interference with
commerce by extortion), or 18 U.S.C. 875(d)(interstate communication of threat to injury
property of another), does not clearly include the operation of a computer, the data or programs
stored in a computer or its peripheral equipment, or the decoding keys to encrypted data.”336
It enacted subparagraphs 1030(a)(7)(B) and (C) in 2008 following the recommendation of the
Department of Justice to “cover the situation in which a criminal has already stolen the
information and threatens to disclose it unless paid off” and in which “other criminals cause
damage first—such as by accessing a corporate computer without authority and encrypting
critical data—and then threaten that they will not correct the problem unless the victim pays.”337
Jurisdiction
Paragraph 1030(a)(7) stands on dual jurisdictional footings. First, a successful prosecution is only
possible if a threat or demand has been transmitted in interstate or foreign commerce, an element
that may be satisfied even in the case of intrastate communications under some circumstances.338
Second, conviction can only be had if the transmitted threat is directed against a protected
computer, that is, one used in or affecting interstate or foreign commerce, one used by or for the
federal government, or one used by or for a financial institution.339
Prior to the 2001 amendment to the definition of “protected computer,” a paragraph 1030(a)(7)
extortion proscription was said to apply to an extortionate threat initiated overseas but directed at
a computer within this country.340 Then in 2001, Congress noted that the class of computers,

336 S.Rept. 104-357 at 12 (1996).
337 H.R. 4175, the Privacy and Cybercrime Enforcement Act of 2007: Hearings Before the Subcomm. on Crime,
Terrorism, and Homeland Security of the House Comm. on the Judiciary
, 110th Cong., 1st Sess. (2007) (statement of
Acting Principal Deputy Assistant Attorney General Andrew Lourie), available at
http://judiciary.house.gov/hearings/hear_121807.html.
338 See e.g., United States v. Kammersell, 196 F.3d 1137, 1138-140 (10th Cir. 1999)(a threat communicated between
two computers in Utah involved interstate communications because the communication was forwarded by way of
AOL’s server in Virginia).
339 18 U.S.C. 1030(e)(2).
340 United States v. Ivanov, 175 F.Supp.2d 367, 374 (D.Conn. 2001).
Congressional Research Service
64

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

protected because of their use in interstate or foreign commerce,341 should be understood to
“include a computer located outside the United States that is used in a manner than affects
interstate or foreign commerce or communication of the United States.”342 The question arises
whether by specifying this particular form of overseas application Congress intended to exclude
all others left unmentioned.343
Threat of “Damage”
Subparagraph 1030(a)(7)(A) proscribes threats to cause computer “damage” and the legislative
history describes its reach in terms consistent with the common understanding of the word
“damage”:
“New Section 1030(a)(7) would close [the] gap in the law and provide penalties for the
interstate or international transmission of threats directed against computers and computer
systems. This covers any interstate or international transmission of threats against computers,
computer networks, and their data and programs whether the threat is received by mail, a
telephone call, electronic mail, or through a computerized messaging service. Unlawful
threats could include interference in any way with the normal operation of the computer or
system in question
, such as denying access to authorized users, erasing or corrupting data or
programs, slowing down the operation of the computer or system, or encrypting data and
then demanding money for the key.”344
Prior to the USA PATRIOT Act amendments, the paragraph did not cover all threats to interfere
with the normal operation of protected computers, but only threats to “damage” protected
computers and only “damage” as then defined in Section 1030, that is, “any impairment to the
integrity or availability of data, a program, a system, or information, that—(A) causes loss
aggregating at least $5,000 in value during any 1-year period to one or more individuals; (B)
modifies or impairs, or potentially modifies or impairs, the medical examination, diagnosis,
treatment, or care of one or more individuals; (C) causes physical injury to any person; or (D)
threatens public health or safety.”345 The USA PATRIOT Act expanded the damage definition and
thus the coverage of the paragraph by reducing the definition to “any impairment to the integrity
or availability of data, a program, a system, or information.”346
Construction of other threat statutes may provide useful insight, however, into what constitutes a
“threat” for purposes of subparagraph 1030(a)(7)(A). Although statements of political hyperbole
may not always constitute true threats,347 a threat is no less a threat because it is contingent, 348

341 18 U.S.C. 1030(e)(2)(B)(2000 ed.).
342 §814(d)(1), P.L. 107-56, 115 Stat. 384 (2001), amending 18 U.S.C. 1030(e)(2)(B).
343 Congress’s uncertainty notwithstanding, at least one district court has confirmed the extraterritorial application of
various statutes – paragraph 1030(a)(7), as well as 18 U.S.C. 1951 (Hobbs Act), 18 U.S.C. 371 (conspiracy), 18 U.S.C.
1029 (access device offenses), and paragraph 1030(a)(4)(fraud) – to misconduct arising out of an overseas extortionate
threat against a commercial computer system in this country, United States v. Ivanov, 175 F.Supp.2d 367 (D.Conn.
2001).
344 S.Rept. 104-357 at 12 (1996)(emphasis added).
345 18 U.S.C. 1030(e)(8)(2000 ed.).
346 18 U.S.C. 1030(e)(8).
347 United States v. Hinkson, 349 F.Supp.2d 1350, 1355 (D. Idaho 2004) (“Certain expressions, including ‘vehement,
caustic, and sometimes unpleasantly sharp attacks on Government and public officials[,]’ may be protected free
speech”)(citing Watts v. United States, 394 U.S. 705, 708 (1969)); United States v. Bly, 510 F.3d 453, 458 (4th Cir.
(continued...)
Congressional Research Service
65

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

because the speaker does not intend or is unable to carry it out,349 because the threat was not
directly communicated to the target,350 or because the language used might be considered cryptic
or ambiguous.351 Whether a particular communication constitutes a threat is a question
determined by whether a reasonable person, considering all the circumstances, would regard the
communication as a threat.352 While the jurisdictional element, such as transmission in interstate
commerce, must be established,353 the government need not show the defendant knew that the
threat had been transmitted in interstate commerce.354
Subparagraphs 1030(a)(7)(B) and (C) differ from the usual threats. Subparagraph (B) addresses
not threats to damage a computer or its data, but threats to breach the confidentiality of that data.
Subparagraph (C) addresses not threats of future damage, but threats to fail to undo damage
already inflicted if extortionate demands are not met.
Intent
The level of intent required for a violation of paragraph 1030(a)(7) differs from the level used for
the fraud provisions of Section 1030. Rather than demand that the offense be committed
“knowingly and with an intent to defraud,” each of the offenses under paragraph 1030(a)(7) must
be committed “with the intent to extort.” Because the crimes are only complete if committed with
this intent to extort, the paragraph anticipates that the offender will have intended his victim to
feel threatened. It thereby avoids some of the uncertainty that has plagued the threat statutes.355

(...continued)
2007). Moreover, “generally, a person who informs someone that he or she is in danger from a third party has not made
a threat,” New York ex rel. Spitzer v. Operation Rescue National, 273 F.3d 184, 196 (2d Cir. 2001).
348 United States v. Patrick, 117 F.3d 375, 377 (8th Cir. 1997)(“That Patrick’s threat was contingent upon his release
from prison does not save him from violating section 876”); United States v. Viefhaus, 168 F.3d 392, 396 (10th Cir.
1999); United States v. Bly, 510 F.3d 453, 459 (4th Cir. 2007); as the phrase “your money or your life” demonstrates,
contingent threats are an essential component of robbery and extortion.
349 United States v. Cassel, 408 F.3d 622, 627-28 (9th Cir. 2005);United States v. Saunders, 166 F.3d 907, 914 (7th Cir.
1999); United States v. Martin, 163 F.3d 1212, 1216 (10th Cir. 1998).
350 United States v. Floyd, 458 F.3d 844, 849 (8th Cir. 2006); United States v. Hinkson, 349 F. Supp. 2d 1350, 1355 (D.
Idaho 2004).
351 United States v. Fulmer, 108 F.3d 1486, 1492 (1st Cir. 1997); United States v. Malik, 16 F.3d 45, 49 (2nd Cir. 1994).
352 United States v. England, 507 F.3d 581, 589 (7th Cir. 2007); United States v. Francis, 164 F.3d 120, 123 (2d Cir.
1999); United States v. Morales, 272 F.3d 284, 287 (5th Cir. 2001). United States v. Stewart, 411 F.3d 825, 828 (7th Cir.
2005) (“The government must prove that the statement came in a context or under such circumstances wherein a
reasonable person would foresee that the statement would be interpreted by those to whom the maker communicates a
statement as a serious expression of an intention to inflict bodily harm upon or to take the life of [another individual].”)
353 United States v. Korab, 893 F.2d 212, 214-15 (9th Cir. 1989).
354 United States v. Darby, 37 F.3d 1059, 1063-64; (4th Cir. 1994); see also, United States v. Kammersell, 196 F.3d
1137, 1139-140 (10th Cir. 1999)(a threatening computer message from defendant in Utah to his girlfriend’s place of
employment within the same state constituted transmission of a threatening communication in interstate commerce
because the message was transmitted by way of the defendant’s service provider’s main server in Virginia; see also
United States v. Guerva, 408 F.3d 252, 259 (5th Cir. 2005)(court finding that threat that led to the temporary closing of
a federal building and the shutting down of various federal agencies resulted in threat affecting interstate commerce).
355 The circuits are divided over the question of whether in order to convict under some of the threat statutes, the
government must show that the defendant intended the victim to feel threatened or merely intended the conduct that a
reasonable person would consider threatening. United States v. Darby, 37 F.3d 1059, 1063-66 (4th Cir. 1994)(and the
conflicting cases cited there)(“To establish a violation of section 875(c) the government must establish that the
defendant intended to transmit the interstate communication and that the communication contained a true threat.... The
(continued...)
Congressional Research Service
66

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Consequences
Penalties and Civil Liability
Violations are punishable by imprisonment for not more than five years (not more than 10 years
for second and subsequent offenses) and/or a fine of not more than $250,000 (not more than
$500,000 for organizations).356 In cases involving more than $5,000 damage or some other
qualifying circumstance, victims may claim the advantages of the civil cause of action for
damages available under subsection 1030(g).357 The general fraud/damage sentencing guideline,
U.S.S.G. §2B1.1, applies to violations of paragraph 1030(a)(7).
Other Consequences
Property derived from, or used to facilitate, an extortion offense under paragraph 1030(a)(7) is
subject to confiscation.358 Offenders may also be ordered to pay restitution.359 Offenses under
the paragraph are not considered federal crimes of terrorism, however.360
Attempt, Conspiracy, and Complicity
The same general observations concerning attempt, conspiracy and aiding and abetting noted with
respect to the other paragraphs of 1030(a) apply here. It is a separate crime to attempt or conspire
to violate paragraph 1030(a)(7).361 Those who attempt or aid and abet the violation of another are
subject to the same penalties as those who commit the substantive offense.362 The same is true of

(...continued)
government does not have to prove that the defendant subjectively intended for the recipient to understand the
communication as a threat”); United States v. Alkhabaz (Baker), 104 F.3d 1492, 1495 (6th Cir. 1997)(“To constitute a
communication containing a threat under Section 875(c), a communication must be such that a reasonable person (1)
would take the statement as a serious express of an intention to inflict bodily harm (the mens rea), and (2) would
perceive such expression as being communicated to effect some change or achieve some goal through intimidation (the
actus reus)”); United States v. Stewart, 411 F.3d 825, 828 (7th Cir. 2005)(“Guilt is not dependent upon what the
defendant intended, but whether the recipient could reasonably have regarded the defendant’s statement as a
threat”)(court declines to follow contradictory Ninth Circuit precedent, id. at 828 n.4); United States v. Parr, 545 F.3d
491, 498-99 (7th Cir. 2008).
356 18 U.S.C. 1030(c)(3), 3571.
357 “ ... A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth
in clause (i), (ii), (iii), (iv), or (v) of subsection (a)(5)(B) ...” 18 U.S.C. 1030(g). The qualifying circumstances
described in clauses (a)(5)(B)(i) through (v) are: “(i) loss to 1 or more persons during any 1-year period (and, for
purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a
related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value; (ii) the
modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment,
or care of 1 or more individuals; (iii) physical injury to any person; (iv) a threat to public health or safety; or (v)
damage affecting a computer system used by or for a government entity in furtherance of the administration of justice,
national defense, or national security.”
358 18 U.S.C. 981(a)(1)(C), 982(a)(2)(B), 1030(i), 1030(j).
359 18 U.S.C. 3663.
360 18 U.S.C. 2332b(g)(5).
361 18 U.S.C. 1030(b), 371.
362 18 U.S.C. 1030(c), 2.
Congressional Research Service
67

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

conspiracies except that conspiracy to commit a felony carries a five year maximum of
imprisonment.363
Other Crimes
Hobbs Act
The Hobbs Act, 18 U.S.C. 1951, prohibits extortion that affects commerce. More precisely,
among other things, it declares that “Whoever in any way or degree obstructs, delays, or affects
commerce or the movement of any article or commodity in commerce, by ... extortion or attempts
or conspires so to do ... shall be fined under this title or imprisoned not more than twenty years, or
both.”364 For Hobbs Act purposes, “‘extortion’ means the obtaining of property from another,
with his consent, induced by wrongful use of ... fear.”365 The government need show only a
minimal impact on interstate or foreign commerce to satisfy the jurisdictional element of the
Hobbs Act.366
Facially, paragraph 1030(a)(7) might seem little more than a more specific version of the Hobbs
Act: the Hobbs Act prohibits the extortionate acquisition of property, generally, in a manner that
affects interstate or foreign commerce; while paragraph 1030(a)(7) prohibits extortionate
acquisition of property, specifically acquired by a threat to damage computers, in a manner that
affects interstate or foreign commerce. But much of §1030 can be explained by Congress’s
concern that its purposes could be frustrated by too narrow a definition of “property.” In most
instances, the fear has been that computer systems or information in computer storage or on
computer disks will be considered too intangible to claim the legal protection available to more
tangible property. The applicability of the Hobbs Act and of the various “threats with intent to
extort” statutes present an additional “property” complication, for they may involve both property
under threat and property sought by the extortionist.
There is little question that the Hobbs Act guards against threats to both tangible and intangible
property. The cases are replete with the observation that wrongful exploitation of a reasonable
fear of economic loss in order to obtain property constitutes extortion for purposes of §1951.367
The case law gives credence to Congress’s concern that some may conclude that the Hobbs Act

363 18 U.S.C. 371.
364 18 U.S.C. 1951(a). For a general discussion see Elements of Offense Proscribed by the Hobbs Act (18 USCS §1951)
Against Racketeering in Interstate or Foreign Commerce
, 4 ALR FED. 881.
365 18 U.S.C. 1951(b)(2).
366 United States v. Carr, 652 F.3d 811, 813 (7th Cir. 2011); United States v. Celaj, 649 F.3d 162, 168 (2d Cir. 2011);
United States v. Manzo
, 636 F.3d 56, 61 (3d Cir. 2011); United States v. Catalan-Roman, 585 F.3d 453, 462 (1st Cir.
2009); United States v. Davis, 473 F.3d 680, 681-83 (6th Cir. 2007); United States v. Vallejo, 297 F.3d 1154, 1166 (11th
Cir. 2002); United States v. Malone, 222 F.3d 1286, 1294-295 (10th Cir. 2000). Some courts may be more demanding
where the victim is an individual rather than a business, United States v. Mann, 493 F.3d 484, 494-95 (5th Cir. 2007);
United States v. Perrotta, 313 F.3d 33, 36 (2d Cir. 2002); United States v. Lynch, 282 F.3d 1049, 1052-55 (9th Cir.
2002).
367 United States v. Vazquez-Botet, 532 F.3d 37, 60 (1st Cir. 2008); Sanchez v. Triple-S Management, Corp., 492 F.3d 1,
12 (1st Cir. 2007); United States v. Mitov, 460 F.3d 901, 907 (7th Cir. 2006);United States v. Edwards, 303 F.3d 606,
635 (5th Cir. 2002); United States v. Collins, 78 F.3d 1021, 1029-30 (6th Cir. 1996); United States v. Middlemiss, 217
F.3d 112, 118 (2nd Cir. 2000).
Congressional Research Service
68

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

does not always reach cases where the “property” obtained by the extortionist is an intangible
benefit rather than tangible property like money.368
Threat Statutes
Several federal statutes prohibit threats against “property” made with extortionate intent. Here the
Hobbs Act puzzle is reversed. Here it is the meaning of the “property” protected from threat that
is uncertain; while the meaning of “property” sought by the extortionist is conceded and spacious.
The statutes in question include at a minimum 18 U.S.C. 875 (threats transmitted in interstate
commerce),369 18 U.S.C. 876 (mailing threatening communications),370 18 U.S.C. 877 (mailing
threatening communications from a foreign country),371 and 18 U.S.C. 880 (receipt of the
proceeds of extortion).372 Other than the receipt statute, they are essentially alike, jurisdictional
elements aside. Each prohibits the communication of a threat to injure the property of the
addressee or of another conveyed with extortionate intent. Each identifies “money or other thing
of value” as the extortionist’s objective, and each punishes offenders by imprisonment for not
more than two years and/or a fine of not more than $250,000.

368 Compare National Organization for Women, Inc. v. Scheidler, 267 F.3d 687, 709 (7th Cir. 2001), rev’d, 537 U.S.
393 (2003)(rejecting a contention that neither women’s right to receive medical services from abortion clinics nor the
clinics’ right to provide such services constituted “property” whose relinquishment under threat would constitute
extortion for Hobbs Act purposes), and United States v. Gigante, 39 F.3d 42, 49-51 (2d Cir. 1994)(holding that the
Hobbs Act extended to a benefit realized when the victim of the threat agreed not to engage in competitive bidding on a
public contract against firms paying kickbacks to the extortionists); with Town of West Hartford v. Operation Rescue,
915 F.2d 92, 101-2 (2nd Cir. 1990)(despite recognition that “‘property’ under the [Hobbs] Act ‘includes in a broad
sense, any valuable right considered as a source or element of wealth’ including a right to solicit business ... the term
‘property’ cannot plausible be construed to encompass altered official conduct,” i.e., increased police and other
emergency services), and United States v. Edwards, 303 F.3d 606, 635 (5th Cir. 2002)(noting that the “property”
threatened for Hobbs Act purposes does not include potential benefits or opportunities). The Supreme Court
subsequently resolved the Hobbs Act issue B not by determining whether the extraction of intangible property is
sufficient to constitute extortion under the Hobbs Act B but by concluding that Hobbs Act extortion requires that the
offender “obtain” something, merely compelling the victim to forego the exercise of a prerogative is insufficient,
Scheidler v. National Organization for Women, Inc., 537 U.S. 393, 402-10 (2003); see also United States v. McFall,
558 F.3d 951, 956-58 (9th Cir. 2009).
369 “Whoever, with intent to extort from any person, firm, association, or corporation, any money or other thing of
value, transmits in interstate or foreign commerce any communication containing any threat to injure the property ... of
the addressee or of another ... shall be fined under this title or imprisoned not more than two years, or both,” 18 U.S.C.
875(d).
370 “Whoever, with intent to extort from any person any money or other thing of value, knowingly so deposits or causes
to be delivered, as aforesaid, any communication, with or without a name or designating mark subscribed thereto,
addressed to any other person and containing any threat to injure the property ... of the addressee or of another ... shall
be fined under this title or imprisoned not more than two years, or both. If such a communication is addressed to a
United States judge, a federal law enforcement officer, or an official who is covered by Section 1114 [any federal
employee], the individual shall be fined under this title, imprisoned not more than 10 years, or both,” 18 U.S.C. 876(d).
371 “ ... Whoever, with intent to extort from any person any money or other thing of value, knowingly so deposits as
aforesaid, any communication, for the purpose aforesaid, containing any threat to injure the property ... of the addressee
or of another ... shall be fined under this title or imprisoned not more than two years, or both,” 18 U.S.C. 877.
372 “A person who receives, possesses, conceals, or disposes of any money or other property which was obtained from
the commission of any offense under this chapter that is punishable by imprisonment for more than 1 year, knowing the
same to have been unlawfully obtained, shall be imprisoned not more than 3 years, fined under this title, or both,” 18
U.S.C. 880.
Congressional Research Service
69

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

As noted earlier, the courts see extraordinary elasticity in the term “thing of value” when used in
federal criminal law,373 but not infrequently are divided over which intangibles may legitimately
be considered “property” for purposes of federal criminal statutes. In the context of mail and wire
fraud, for instance, the Supreme Court held that an earlier version of those statutes did not reach
schemes to defraud another of intangibles in the form of the honest services of public officials,
(McNally) nor a scheme to fraudulently acquire a state-issued license (Cleveland), but did reach
schemes to defraud another of confidential information (Carpenter).374 Again, even in the case of
the more narrowly construed statutes, however, the data and other intangibles at issue in computer
cases would seem to more clearly resemble the Carpenter “confidential information” property
than the McNally “honest public services” or the Cleveland “unissued license” property.375
RICO, Money Laundering, and the Travel Act
Section 1030 is a money laundering predicate offense.376 Thus, financial transactions involving
the proceeds from computer-related extortion that violate paragraph 1030(a)(7) may support a
prosecution under 18 U.S.C. 1956 or 1957. Moreover, a violation of paragraph 1030(a)(7) may at
the same time offend one of its companions that is a RICO predicate, for example, the Hobbs Act,
18 U.S.C. 875 (extortion affecting in interstate or foreign commerce), or the Travel Act (extortion
is a Travel Act predicate), thereby raising the prospect of a RICO prosecution.

373 See, United States v. Ramos-Arenas, 596 F.3d 783, 787 (10th Cir. 2010)(law enforcement forbearance constitutes a
thing of value); United States v. Maneri, 353 F.3d 165, 168 (2d Cir. 2003)(thing of value included opportunity for
sexual encounter); United States v. Freeman, 208 F.3d 332, 341 (1st Cir. 2000)(night club owner’s special treatment of
police officer including access to dancers’ dressing room constituted a thing of value); United States v. Marmolejo, 89
F.3d 1185, 1192-193 (5th Cir. 1996)(citing a wide range of intangible property benefits found to constitute “things of
value” under various federal criminal statutes); United States v. Bryant, 117 F.3d 1464, 1468 n.7 (D.C.Cir. 1997)
(noting that a forbearance from arrest constitutes a “thing of value” for purposes of 18 U.S.C. 912 even in a case where
two members of the three judge panel expressed the view that the defendant should never have been charged,
prosecuted or convicted); United States v. Collins, 56 F.3d 1416, 1420 (D.C.Cir. 1995)(noting the widespread
acceptance of an expansive reading of the term “thing of value” the purposes of the theft of federal property statute, 18
U.S.C. 641). The things of value are not limited to those things that can be lawfully possessed, see e.g., United States v.
Sargent
, 504 F.3d 767, 770-71 (9th Cir. 2007)(marijuana); United States v. Fink, 502 F.3d 585, 586 (6th Cir. 2007)(child
pornography).
374 McNally v. United States, 483 U.S. 350, 356 (1987); Carpenter v. United States, 484 U.S. 19, 25-6 (1987); United
States v. Salvatore
, 110 F.3d 1131, 1139-141 (5th Cir. 1997)(noting the McNally-Carpenter distinction and the
subsequent split of appellate courts on the question of whether unissued licenses may constitute “property” interests for
purposes of the mail fraud statute, 18 U.S.C. 1341, a conflict which the Supreme Court subsequently resolved in
Cleveland v. United States, 531 U.S. 12, 26-7 (2000) when it concluded that a state had not been defrauded of
“property” for the purposes of §1341 when it was fraudulently induced to issue a license); see also United States v.
Delano
, 55 F.3d 720, 726-27 (2d Cir. 1995)(holding that labor or services cannot be considered “property” for purposes
of a RICO charge based on an extortionate predicate offense). United States v. Hedaithy, 392 F.3d 580, 584 (3d Cir.
2004) (court found that mail fraud violation occurred when would-be test takers had others take a standardized test in
their place; the court found that the testing service’s property interests were violated because of the unauthorized use of
its copyrighted and confidential materials and because, in obtaining a score report, the defendants possessed the
“embodiment of the services that ETS provides”).
375 Cf., United States v. Bastian, 603 F.3d 460, 466 (8th Cir. 2010)(receipt of bartered pornographic computer files
constituted things of value); United States v. Jordan, 582 F.3d 1239, 1246 (11th Cir. 2009)(information from the FBI’s
computerized criminal record files (NCIC records) constituted a thing of value).
376 18 U.S.C. 1956(c)(7)(D), 1957(f)(3).
Congressional Research Service
70

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Trafficking in Computer Access
(18 U.S.C. 1030(a)(6))

(a) Whoever ... (6) knowingly and with intent to defraud traffics (as defined in Section 1029)
in any password or similar information through which a computer may be accessed without
authorization, if
(A) such trafficking affects interstate or foreign commerce; or (B) such
computer is used by or for the Government of the United States ... shall be punished as
provided in subsection (c) of this section.
(b) Whoever attempts to commit an offense under subsection (a) of this section shall be
punished as provided in subsection (c) of this section.

Paragraph 1030(a)(6) outlaws misconduct similar to the access device proscriptions of 18 U.S.C.
1029.377 It was enacted to deal with the practice of hackers posting the passwords for various
computer systems on electronic bulletin boards.378 Although limited, it provides several distinct
advantages. First, it covers passwords for government computers more clearly than does §1029.
Second, as something of a lesser included offense to §1029, it affords the government plea
bargaining room in a case that it might otherwise be forced to bring under §1029 or abandon.
Third, it contributes a means of cutting off the practice of publicly posting access to confidential
computer systems without imposing severe penalties unless the misconduct persists. Fourth, it
supplies a basis for private enforcement through the civil liability provisions of subsection
1030(g) for misconduct that may be more appropriately addressed by the courts as a private
wrong. Nevertheless, the paragraph has apparently been invoked only infrequently.379 The
elements of the crime are
• knowingly and with an intent to defraud;
• trafficking in (i.e., “to transfer, or otherwise dispose of, to another, or obtain
control of with intent to transfer or dispose of” (18 U.S.C. 1029(e)(5)));
• a computer password or similar computer key; and
• either
- of a federal computer or
- in a manner that affects interstate or foreign commerce.
Jurisdiction
Federal jurisdiction exists where the traffic affects interstate or foreign commerce,380 or where the
password or key is to a computer used by or for the Government of the United States.381 As has
been said of other paragraphs and government computers, it is unclear whether the protection of

377 “Whoever ... knowingly and with intent to defraud traffics in or uses one or more unauthorized access devices
during any one-year period, and by such conduct obtains anything of value aggregating $1,000 or more during that
period ... shall, if the offense affects interstate or foreign commerce, be punished as provided in subsection (c) of this
section,” 18 U.S.C. 1029(a)(2).
378 S.Rept. 99-432 at 13 (1986); H.Rept. 99-612 at 12-3 (1986).
379 AtPac, Inc. v. Aptitude Solutions, Inc., 730 F.Supp.2d 1174, 1182 (E.D.Cal. 2010)(“The court notes that, in the
course of its own research, it has come across only a handful of federal cases that even mention §1030(a)(6)”).
380 18 U.S.C. 1030(a)(6)(A).
381 18 U.S.C. 1030(a) (6)(B).
Congressional Research Service
71

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

paragraph 1030(a)(6) cloaks legislative and judicial branch computers or is limited to those of the
executive branch. The uncertainty is born of the section’s care to define the phrase “department or
agency of the United States” to include all three branches and its use of that phrase in establishing
some crimes, contrasted with its failure to use that phrase in paragraph 1030(a)(6), discussed
supra. The explicit reference to overseas application of offenses affecting commerce under
subparagraph 1030(e)(2), without a similar statement concerning government computers, may
raise further uncertainty. Was the omission an oversight or intended to signal a limitation?
Intent
The intent element is the same as that used in paragraph 1030(a)(4)(fraud), and in the credit card
fraud proscriptions of 18 U.S.C. 1029: knowingly and with the intent to defraud.382 The phrase as
used in the credit card fraud statute means that the offender is conscious of the natural
consequences of his action (i.e., that it is likely that someone will be defrauded) and intends that
those consequences should occur (i.e., he intends that someone should be defrauded).383
Consequences
Penalties
The first offense is punishable by imprisonment for not more than one year and/or a fine of not
more than $100,000 (not more $200,000 for organizations); subsequent offenses are punishable
by imprisonment for not more than 10 years and/or a fine of not more than $250,000 (not more
than $500,000 for organizations).384 The general theft/damage sentencing guideline, U.S.S.G.
§2B1.1, covers violations of paragraph 1030(a)(6) (traffic in passwords) as it does fraud and
damage under paragraphs 1030(a)(4) and 1030(a)(5).
Other Consequences
Proceeds and property traceable to the proceeds of a violation of paragraph 1030(a)(6) trafficking
offenses are subject to confiscation. 385 Upon conviction, defendants are ordered to pay
restitution.386 And, offenders may also be subject to a cause of action for damages or injunctive
relief.387 Victims, who sue on grounds that the offense caused more than $5,000 in losses, may
include lost revenues as well as the cost of damage assessment and of corrective and preventive
measures.388

382 S.Rept. 99-432 at 10 (1986); H.Rept. 99-612 at 12 (1986); AtPac, Inc. v. Aptitude Solutions, Inc., 730 F.Supp.2d
1174, 1183 (E.D. Cal. 2010)(“‘[I]ntent to defraud’ requires more than the intent to impermissible give access to
another”); see also State Analysis, Inc. v. American Financial Services Assoc., 621 F.Supp.2d 309, 317 (E.D. Va.
2009)(holding that a simple unauthorized disclosure and use of a password does not constitute “trafficking” for
purposes of paragraph 1030(a)(6)).
383 H.Rept. 98-894 at 16-7 (1984).
384 18 U.S.C. 1030(c)(2), 3571.
385 18 U.S.C. 981(a)(1)(C), 982(a)(2)(B), 1030(i), (j).
386 18 U.S.C. 3663A(c)(1)(A)(ii).
387 18 U.S.C. 1030(g).
388 18 U.S.C. 1030(e)(11); AtPac, Inc. v. Aptitude Solutions, Inc., 730 F.Supp.2d at 1184.
Congressional Research Service
72

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Other Crimes
The generally applicable provisions dealing with attempt, conspiracy and complicity will apply
with equal force in cases involving paragraph 1030(a)(6). Paragraph 1030(a)(6) appears to have
few counterparts in federal law, other than the prohibition against trafficking in access devices
(credit card fraud) under 18 U.S.C. 1029(a)(2) 389 and the wire fraud provisions of 18 U.S.C.
1343.390 Nevertheless, violations of either of these—or of the money laundering proscriptions (18
U.S.C. 1956, 1957) for which §1030 is a predicate—may provide the foundation for a RICO (18
U.S.C. 1962) prosecution, so that should conduct in violation of paragraph 1030(a)(6) also offend
either the mail fraud, credit card fraud, or money laundering prohibitions, a criminal breach of
RICO may also have occurred. Brokering computer passwords without more may not be the
ground upon which a sprawling criminal enterprise might be built, but violations of paragraph
1030(a)(6), with other crimes, might be part of a pattern of criminal activity used to operate such
an enterprise.391
Computer Espionage (18 U.S.C. 1030(a)(1))
(a) Whoever ... (1) having knowingly accessed a computer without authorization or
exceeding authorized access, and by means of such conduct having obtained information
that has been determined by the United States Government pursuant to an Executive order or
statute to require protection against unauthorized disclosure for reasons of national defense
or foreign relations, or any restricted data, as defined in paragraph y of Section 11 of the
Atomic Energy Act of 1954, with reason to believe that such information so obtained could
be used to the injury of the United States, or to the advantage of any foreign nation willfully
communicates, delivers, transmits, or causes to be communicated, delivered, or transmitted,
or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or
transmitted the same to any person not entitled to receive it, or willfully retains the same and
fails to deliver it to the officer or employee of the United States entitled to receive it ... shall
be punished as provided in subsection (c) of this section.
(b) Whoever attempts to commit an offense under subsection (a) of this section shall be
punished as provided in subsection (c) of this section.

Paragraph 1030(a)(1) essentially tracks existing federal espionage laws—18 U.S.C. 793, 794 and
798—that ban disclosure of information potentially detrimental to U.S. national defense and well
being, or more simply, laws that outlaw spying.392 The paragraph was enacted as part of the

389 Prosecution under paragraph 1029(a)(2) requires a loss of at least $1,000 over the course of a year and that the
device permit access to an “account,” 18 U.S.C. 1029(e)(1)(defining “access device”); paragraph 1030(a)(6) imposes
neither burden upon a prosecution. This is probably why paragraph 1030(a)(6) is punishable as a misdemeanor while
paragraph 1029(a)(2) is a 10-year felony.
390 To establish wire fraud, the government must show an interstate wire transmission in furtherance of a scheme to
defraud another of money or property, United States v. Mann, 493 U.S. 484, 493 (5th Cir. 2007); United States v. Allen,
491 F.3d 178, 185 (4th Cir. 2007); United States v. Dowlin, 408 F.3d 647, 658 n.5 (10th Cir. 2005); United States v.
Owens
, 301 F.3d 521, 528 (7th Cir. 2002).
391 Prosecution under 18 U.S.C. 1029 may also include charges of unauthorized access under paragraph 1030(a)(2), see
e.g., United States v. John, 597 F.3d 263 (5th Cir. 2010).
392 For a discussion of federal espionage laws generally see, 70 AMERICAN JURISPRUDENCE, 2D EDITION, Sedition,
Subversive Activities, and Treason
§§17-44; see also, Williams, (Spy) Game Change: Cyber Networks, Intelligence
Collecting, and Cover Action
, 79 GEORGE WASHINGTON LAW REVIEW 1162 (2011); Bazan, Espionage and the Death
Penalty
, 41 FEDERAL BAR NEWS & JOURNAL 615 (1994); Vladeck, Inchoate Liability and the Espionage Act: The
Statutory Framework and the Freedom of the Press
, 1 HARVARD LAW & POLICY REVIEW 219 (2007).
Congressional Research Service
73

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

original act and has been amended primarily to more closely track other espionage laws.393 The
distinctive feature of paragraph 1030(a)(1) is its merger of elements of espionage and computer
abuse.394 Broken down into a simplified version of its constituent elements it bars anyone from
• either
- willfully disclosing,
- willfully attempting to disclose, or
- willfully failing to return
• classified information concerning national defense, foreign relations or atomic
energy
• with reason to believe that the information either
- could be used to injure the United States, or
- could be used to the advantage of a foreign nation
• when the information was acquired by unauthorized computer access.
Jurisdiction
The federal government is a creature of the Constitution. It enjoys only those powers that the
Constitution grants it.395 Since the states are primarily responsible for the enactment and
enforcement of criminal law, the validity of any federal criminal law depends upon a clear nexus
to some power that the Constitution vests in the national government. Most of subsection 1030(a)
represents the execution of Congress’s authority to enact laws for the regulation of interstate and
foreign commerce, for example.396 Paragraph 1030(a)(1), on the other hand, is anchored in the
protection of the defense and foreign relations of the nation,397 and so jurisdictional ties to
interstate or foreign commerce are unnecessary.

393 18 U.S.C. 1030 (1982 ed. & 1984 Supp.); H.Rept. 98-894 at 21 (1984). Compare the language of 1030(a)(1) with
that of 18 U.S.C. 793(e)(“Whoever having unauthorized possession of, access to, or control over any document,
writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument,
appliance, or note relating to the national defense, or information relating to the national defense which information the
possessor has reason to believe could be used to the injury of the United States or to the advantage of any foreign
nation, willfully communicates, delivers, transmits or causes to be communicated, delivered, or transmitted, or attempts
to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not
entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States
entitled to receive it”).
394 “Although there is considerable overlap between 18 U.S.C. 793(3) and section 1030(a)(1), as amended by the NII
Protection Act, the two statutes would not reach exactly the same conduct. Section 1030(a)(1) would target those
persons who deliberately break into a computer to obtain properly classified Government secrets then try to peddle
those secrets to others, including foreign governments. In other words, unlike existing espionage laws prohibiting the
theft and peddling of Government secrets to foreign agents, section 1030(a)(1) would require proof that the individual
knowingly used a computer without authority, or in excess of authority, for the purpose of obtaining classified
information. In this sense then, it is the use of the computer which is being proscribed, not the unauthorized possession
of, access to, or control over the classified information itself,” S.Rept. 104-357 at 6-7 (1996).
395 U.S. Const. Amend. IX, X.
396 U.S. Const. Art.I, §8, cl.3.
397 U.S.Const. Art. I, §8, cls. 11-16; Art. II, §2, cls.1, 2.
Congressional Research Service
74

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Intent
The state of mind element for a breach of paragraph 1030(a)(1) is pegged higher than the other
subsection 1030(a) offenses. The offender must (1) purposefully transmit or retain information
that (2) he has reason to believe could be used to the injure the United States or benefit another
country, and (3) that he has obtained through access to a computer that he knows he had no
authority to access.398
Consequences
Penalties and Sentencing Guidelines
Violations are punishable by imprisonment for not more than 10 years (not more than 20 years for
second and subsequent offenses) and/or a fine of not more than $250,000 (not more than
$500,000 for organizations).399 The general espionage sentencing guideline, U.S.S.G. §2M3.2,
applies to violations of paragraph (a)(1) which calls for a base sentencing level of 30 (carrying an
initial sentencing range beginning at 8 years’ imprisonment) and of 35 (an initial sentencing range
beginning at 14 years) if top secret information is involved. Paragraph 1030(a)(1) offenses are
federal crimes of terrorism.400 Thus, if a violation is committed for terrorist purposes,401 the
minimum sentencing level is 32 and the criminal history category is VI which means the
sentencing range begins at 17.5 years’ imprisonment (and begins at 24.33 years’ imprisonment if
top secret information is involved).402
Federal Crime of Terrorism
Because paragraph 1030(a)(1) is a federal crime of terrorism,403
• the applicable statute of limitations is 8 years rather than 5 years;404
• pretrial detention of defendants charged with a violation of paragraph 1030(a)(1)
is presumed;405 and
• conviction carries the prospect of life-time supervision by probation
authorities;406

398 H.Rept. 98-894 at 21 (1984)(“As the Supreme Court stated in Gorin v. U.S., (312 U.S. 19, 28), ‘This requires those
prosecuted to have acted in bad faith. The sanctions apply only when scienter is established’”).
399 18 U.S.C. 1030(c)(1), 3571.
400 18 U.S.C. 2332b(g)(5)(B).
401 U.S.S.G. §3A1.4, cmt., app. n. 1(“For purposes of this guideline, ‘federal crime of terrorism’ has the meaning given
at that term in 18 U.S.C. §2332b(g)(5)”); 18 U.S.C. 2332b(g)(5)(A)( “[T]he term ‘Federal crime of terrorism’ means an
offense that – (A) is calculated to influence or affect the conduct of government by intimidation or coercion, or to
retaliate against government conduct ...”).
402 U.S.S.G. §3A1.4.
403 18 U.S.C. 2332b(g)(5)(B).
404 18 U.S.C. 3286.
405 18 U.S.C. 3142.
406 18 U.S.C. 3583.
Congressional Research Service
75

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Other Consequences
A paragraph 1030(a)(1) offense will provide the basis for a sentencing enhancement or for
additional charges, if it is committed in conjunction with
• aggravated identity theft;407
• RICO;408
• money laundering;409
• maritime transportation of terrorists;410 and
• providing material support for terrorist organizations.411
Moreover, proceeds generated from a paragraph 1030(a)(1) espionage offense, as well as personal
property such as computers used to facilitate the offense, are subject to confiscation.412 Upon
conviction, defendants are ordered to pay restitution.413 And, offenders may also be subject to a
cause of action for damages or injunctive relief.414
Attempt, Conspiracy, and Complicity
The same general observations concerning attempt, conspiracy and aiding and abetting noted with
respect to the other paragraphs of 1030(a) apply here. It is a separate crime to attempt to violate
paragraph 1030(a)(7).415 Those who attempt or aid and abet the violation of another are subject to
the same penalties as those who commit the substantive offense.416 The same is true of
conspiracies, if they are prosecuted under the general conspiracy statute rather than under
subsection 1030(b). Conviction under the general conspiracy statute is punishable by
imprisonment for not more than 5 years, regardless of the maximum penalty available for
underlying substantive offense as long as the underlying offense is a felony.417
Other Crimes
Espionage prosecutions are not common. And there do not appear to have been any reported cases
brought under paragraph 1030(a)(1). The overlap between paragraph 1030(a)(1) and the
espionage laws is such, however, that any case prosecutable under paragraph 1030(a)(1) would
likely also be prosecutable under one or more of the espionage statutes; in fact “the only reported

407 18 U.S.C. 1028.
408 18 U.S.C. 1961.
409 18 U.S.C. 1030(i), (j).
410 18 U.S.C. 2284.
411 18 U.S.C. 2339A.
412 18 U.S.C. 981(a)(1)(C), 982(a)(2)(B), 1030(i), (j).
413 18 U.S.C. 3663A(c)(1)(A)(ii).
414 18 U.S.C. 1030(g).
415 18 U.S.C. 1030(b).
416 18 U.S.C. 1030(c), 2.
417 18 U.S.C. 371.
Congressional Research Service
76

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

‘espionage’ case involving the unauthorized use of computers was prosecuted under §793, the
much older, pre-electronic espionage statute and not under §1030(a)(1).”418
Espionage Offenses
The three espionage statutes share common ground under some circumstances. In general terms,
they outlaw gathering and disseminating defense information (18 U.S.C. 793); gathering and
disseminating defense information for a foreign country (18 U.S.C. 794); and disclosing
classified information concerning government cryptography or communications intelligence (18
U.S.C. 798).
As already noted, 18 U.S.C. 793(e) is the generic twin of 1030(a)(1), but §793 has several other
provisions that might also be implicated by a fact pattern sufficient to establish criminal liability
under paragraph 1030(a)(1). Section 793 establishes six distinct offenses:
• intruding upon military facilities to gather national defense information;419
• copying documents containing national defense information;420
• unlawful receipt of national defense information;421
• unlawful dissemination of national defense information by a lawful custodian;422

418 Olivenbaum, <CTRL><ALT><DELETE>: Rethinking Federal Computer Crime Legislation, 27 SETON HALL LAW
REVIEW 574, 594-95 (1997), citing United States v. Poulsen, 41 F.3d 1330 (9th Cir. 1994); see also, DoJ Cyber Crime at
13 (“Violations of this subsection are charged quite rarely. The reason for its lack of prosecution may well be the close
similarities between sections 1030(a)(1) and783(e). In situations where both statutes are applicable, prosecutors may
tend towards using section 793(e), for which guidance and precedent are more prevalent”).
419 “Whoever, for the purpose of obtaining information respecting the national defense with intent or reason to believe
that the information is to be used to the injury of the United States, or to the advantage of any foreign nation, goes
upon, enters, flies over, or otherwise obtains information concerning any vessel, aircraft, work of defense, navy yard,
naval station, submarine base, fueling station, fort, battery, torpedo station, dockyard, canal, railroad, arsenal, camp,
factory, mine, telegraph, telephone, wireless, or signal station, building, office, research laboratory or station or other
place connected with the national defense owned or constructed, or in progress of construction by the United States or
under the control of the United States, or of any of its officers, departments, or agencies, or within the exclusive
jurisdiction of the United States, or any place in which any vessel, aircraft, arms, munitions, or other materials or
instruments for use in time of war are being made, prepared, repaired, stored, or are the subject of research or
development, under any contract or agreement with the United States, or any department or agency thereof, or with any
person on behalf of the United States, or otherwise on behalf of the United States, or any prohibited place so designated
by the President by proclamation in time of war or in case of national emergency in which anything for the use of the
Army, Navy, or Air Force is being prepared or constructed or stored, information as to which prohibited place the
President has determined would be prejudicial to the national defense ... Shall be fined under this title or imprisoned not
more than ten years, or both,” 18 U.S.C. 793(a).
420 “Whoever, for the purpose aforesaid, and with like intent or reason to believe, copies, takes, makes, or obtains, or
attempts to copy, take, make, or obtain, any sketch, photograph, photographic negative, blueprint, plan, map, model,
instrument, appliance, document, writing, or note of anything connected with the national defense ... Shall be fined
under this title or imprisoned not more than ten years, or both,”18 U.S.C. 793(b).
421 “Whoever, for the purpose aforesaid, receives or obtains or agrees or attempts to receive or obtain from any person,
or from any source whatever, any document, writing, code book, signal book, sketch, photograph, photographic
negative, blueprint, plan, map, model, instrument, appliance, or note, of anything connected with the national defense,
knowing or having reason to believe, at the time he receives or obtains, or agrees or attempts to receive or obtain it, that
it has been or will be obtained, taken, made, or disposed of by any person contrary to the provisions of this chapter ...
Shall be fined under this title or imprisoned not more than ten years, or both,”18 U.S.C. 793(c).
422 “Whoever, lawfully having possession of, access to, control over, or being entrusted with any document, writing,
code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance,
(continued...)
Congressional Research Service
77

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

• unauthorized possession of national defense information;423 and
• negligently losing national defense information.424
Violations of Section 793 and conspiracies to violate subject offenders to the same penalties:
imprisonment for not more than 10 years (not more than 20 years for a subsequent offense) and/or
a fine of not more than $250,000 (not more than $500,000 for organizations),425 and criminal
forfeiture of any proceeds derived from the offense.426
Section 794 essentially subjects transgressions similar to those banned in Section 793 to more
severe penalties, if they involve gathering national defense information for a foreign nation or to
injure the United States,427 particularly if the offense is committed in wartime.428 Conspirators are

(...continued)
or note relating to the national defense, or information relating to the national defense which information the possessor
has reason to believe could be used to the injury of the United States or to the advantage of any foreign nation, willfully
communicates, delivers, transmits or causes to be communicated, delivered, or transmitted or attempts to communicate,
deliver, transmit or cause to be communicated, delivered or transmitted the same to any person not entitled to receive it,
or willfully retains the same and fails to deliver it on demand to the officer or employee of the United States entitled to
receive it ... Shall be fined under this title or imprisoned not more than ten years, or both,”18 U.S.C. 793(d). United
States v. Abu-Jihaad
, 630 F.3d 102, (2d Cir, 2010)(For a conviction under subsection 793(d), “the government was
required to prove beyond a reasonable doubt that [the defendant] (1) lawfully had possession of, access to, control over,
or was entrusted with information relating to the national defense; (2) had reason to believe that such information could
be used to the injury of the United States or to the advantage of any foreign nation; (3) willfully communicated,
delivered, transmitted, or caused to be communicated, delivered, or transmitted such information; and (4) did so to a
person not entitled to receive it”); United States v. Kim, 808 F.Supp.2d 44, 55-7 (D.D.C. 2011)(noting the elements of
the offense and rejecting the argument that the subsection impermissibly constituted a content-based restriction on the
defendant’s First Amendment right to free speech).
423 “Whoever having unauthorized possession of, access to, or control over any document, writing, code book, signal
book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, or note relating to
the national defense, or information relating to the national defense which information the possessor has reason to
believe could be used to the injury of the United States or to the advantage of any foreign nation, willfully
communicates, delivers, transmits or causes to be communicated, delivered, or transmitted, or attempts to
communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not
entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States
entitled to receive it ... Shall be fined under this title or imprisoned not more than ten years, or both,” 18 U.S.C. 793(e)
424 “Whoever, being entrusted with or having lawful possession or control of any document, writing, code book, signal
book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, note, or
information, relating to the national defense, (1) through gross negligence permits the same to be removed from its
proper place of custody or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed, or
(2) having knowledge that the same has been illegally removed from its proper place of custody or delivered to anyone
in violation of his trust, or lost, or stolen, abstracted, or destroyed, and fails to make prompt report of such loss, theft,
abstraction, or destruction to his superior officer ... Shall be fined under this title or imprisoned not more than ten years,
or both,” 18 U.S.C. 793(f).
425 18 U.S.C. 793(g).
426 18 U.S.C. 793(h).
427 “Whoever, with intent or reason to believe that it is to be used to the injury of the United States or to the advantage
of a foreign nation, communicates, delivers, or transmits, or attempts to communicate, deliver, or transmit, to any
foreign government, or to any faction or party or military or naval force within a foreign country, whether recognized
or unrecognized by the United States, or to any representative, officer, agent, employee, subject, or citizen thereof,
either directly or indirectly, any document, writing, code book, signal book, sketch, photograph, photographic negative,
blueprint, plan, map, model, note, instrument, appliance, or information relating to the national defense, shall be
punished by death or by imprisonment for any term of years or for life, except that the sentence of death shall not be
imposed unless the jury or, if there is no jury, the court, further finds that the offense resulted in the identification by a
foreign power (as defined in Section 101(a) of the Foreign Intelligence Surveillance Act of 1978) of an individual
acting as an agent of the United States and consequently in the death of that individual, or directly concerned nuclear
(continued...)
Congressional Research Service
78

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

subject to the same penalties,429 and property derived from a violation or used to facilitate a
violation is subject to forfeiture.430
Section 798 protects military and diplomatic codes and government code breaking. It proscribes
unlawful dissemination of classified information concerning communications intelligence and
government cryptography.431 Violations are punishable by imprisonment for not more than 10
years and/or a fine of not more than $250,000,432 and the confiscation of any property derived
from the offense or used to facilitate its commission.433

(...continued)
weaponry, military spacecraft or satellites, early warning systems, or other means of defense or retaliation against
large-scale attack; war plans; communications intelligence or cryptographic information; or any other major weapons
system or major element of defense strategy,” 18 U.S.C. 794(a).
428 “Whoever, in time of war, with intent that the same shall be communicated to the enemy, collects, records,
publishes, or communicates, or attempts to elicit any information with respect to the movement, numbers, description,
condition, or disposition of any of the Armed Forces, ships, aircraft, or war materials of the United States, or with
respect to the plans or conduct, or supposed plans or conduct of any naval or military operations, or with respect to any
works or measures undertaken for or connected with, or intended for the fortification or defense of any place, or any
other information relating to the public defense, which might be useful to the enemy, shall be punished by death or by
imprisonment for any term of years or for life,” 18 U.S.C. 794(b).
429 18 U.S.C. 794(c).
430 18 U.S.C. 794(d).
431 “(a) Whoever knowingly and willfully communicates, furnishes, transmits, or otherwise makes available to an
unauthorized person, or publishes, or uses in any manner prejudicial to the safety or interest of the United States or for
the benefit of any foreign government to the detriment of the United States any classified information – (1) concerning
the nature, preparation, or use of any code, cipher, or cryptographic system of the United States or any foreign
government; or (2) concerning the design, construction, use, maintenance, or repair of any device, apparatus, or
appliance used or prepared or planned for use by the United States or any foreign government for cryptographic or
communication intelligence purposes; or (3) concerning the communication intelligence activities of the United States
or any foreign government; or (4) obtained by the processes of communication intelligence from the communications
of any foreign government, knowing the same to have been obtained by such processes – Shall be fined under this title
or imprisoned not more than ten years, or both.
“(b) As used in subsection (a) of this section – The term ‘classified information’ means information which, at the
time of a violation of this section, is, for reasons of national security, specifically designated by a United States
Government Agency for limited or restricted dissemination or distribution; The terms ‘code,’ ‘cipher,’ and
‘cryptographic system’ include in their meanings, in addition to their usual meanings, any method of secret writing and
any mechanical or electrical device or method used for the purpose of disguising or concealing the contents,
significance, or meanings of communications; The term ‘foreign government’ includes in its meaning any person or
persons acting or purporting to act for or on behalf of any faction, party, department, agency, bureau, or military force
of or within a foreign country, or for or on behalf of any government or any person or persons purporting to act as a
government within a foreign country, whether or not such government is recognized by the United States; The term
‘communication intelligence’ means all procedures and methods used in the interception of communications and the
obtaining of information from such communications by other than the intended recipients; The term ‘unauthorized
person’ means any person who, or agency which, is not authorized to receive information of the categories set forth in
subsection (a) of this section, by the President, or by the head of a department or agency of the United States
Government which is expressly designated by the President to engage in communication intelligence activities for the
United States.
“(c) Nothing in this section shall prohibit the furnishing, upon lawful demand, of information to any regularly
constituted committee of the Senate or House of Representatives of the United States of America, or joint committee
thereof.”
432 18 U.S.C. 798(a), 3571.
433 18 U.S.C. 798(d).
Congressional Research Service
79

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

Economic Espionage
The economic espionage prohibition, 18 U.S.C. 1831, outlaws stealing, copying, or unlawfully
possessing a trade secret for the benefit of a foreign entity or attempting or conspiring to do so.434
Offenders face imprisonment for not more than 15 years and a higher fine than is authorized for
most felonies—not more than $500,000 (not more than $10 million for organizations).435

434 “Whoever, intending or knowing that the offense will benefit any foreign government, foreign instrumentality, or
foreign agent, knowingly—(1) steals, or without authorization appropriates, takes, carries away, or conceals, or by
fraud, artifice, or deception obtains a trade secret; (2) without authorization copies, duplicates, sketches, draws,
photographs, downloads, uploads, alters, destroys, photocopies, replicates, transmits, delivers, sends, mails,
communicates, or conveys a trade secret; (3) receives, buys, or possesses a trade secret, knowing the same to have been
stolen or appropriated, obtained, or converted without authorization; (4) attempts to commit any offense described in
any of paragraphs (1) through (3); or (5) conspires with one or more other persons to commit any offense described in
any of paragraphs (1) through (3), and one or more of such persons do any act to effect the object of the conspiracy,—
shall, except as provided in subsection (b), be fined not more than $500,000 or imprisoned not more than 15 years, or
both,” 18 U.S.C. 1831(a).
435 Id.
Congressional Research Service
80

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

18 U.S.C. 1030. Computer Fraud and Abuse (text)
(a) Whoever—
(1) having knowingly accessed a computer without authorization or exceeding authorized access, and by
means of such conduct having obtained information that has been determined by the United States
Government pursuant to an Executive order or statute to require protection against unauthorized disclosure
for reasons of national defense or foreign relations, or any restricted data, as defined in paragraph y. of
section 11 of the Atomic Energy Act of 1954, with reason to believe that such information so obtained
could be used to the injury of the United States, or to the advantage of any foreign nation willfully
communicates, delivers, transmits, or causes to be communicated, delivered, or transmitted, or attempts to
communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any
person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or
employee of the United States entitled to receive it;
(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby
obtains—
(A) information contained in a financial record of a financial institution, or of a card issuer as defined
in section 1602(n) of title 15, or contained in a file of a consumer reporting agency on a consumer, as
such terms are defined in the Fair Credit Reporting Act 15 U.S.C. 1681 et seq.);
(B) information from any department or agency of the United States; or
(C) information from any protected computer;
(3) intentionally, without authorization to access any nonpublic computer of a department or agency of
the United States, accesses such a computer of that department or agency that is exclusively for the use of
the Government of the United States or, in the case of a computer not exclusively for such use, is used by
or for the Government of the United States and such conduct affects that use by or for the Government of
the United States;
(4) knowingly and with intent to defraud, accesses a protected computer without authorization, or
exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything
of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and
the value of such use is not more than $5,000 in any 1-year period;
(5)(A) knowingly causes the transmission of a program, information, code, or command, and as a result
of such conduct, intentionally causes damage without authorization, to a protected computer;
(B) intentionally accesses a protected computer without authorization, and as a result of such conduct,
recklessly causes damage; or
(C) intentionally accesses a protected computer without authorization, and as a result of such conduct,
causes damage and loss.
(6) knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar
information through which a computer may be accessed without authorization, if--
(A) such trafficking affects interstate or foreign commerce; or
(B) such computer is used by or for the Government of the United States.
(7) with intent to extort from any person any money or other thing of value, transmits in interstate or
foreign commerce any communication containing any—
(A) threat to cause damage to a protected computer;
(B) threat to obtain information from a protected computer without authorization or in excess of
authorization or to impair the confidentiality of information obtained from a protected computer
without authorization or by exceeding authorized access; or
(C) demand or request for money or other thing of value in relation to damage to a protected
computer, where such damage was caused to facilitate the extortion;

shall be punished as provided in subsection (c) of this section.

(b) Whoever conspires to commit or attempts to commit an offense under subsection (a) of this section
shall be punished as provided in subsection (c) of this section.

(c) The punishment for an offense under subsection (a) or (b) of this section is—
Congressional Research Service
81

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

(1)(A) a fine under this title or imprisonment for not more than ten years, or both, in the case of an
offense under subsection (a)(1) of this section which does not occur after a conviction for another offense
under this section, or an attempt to commit an offense punishable under this subparagraph; and
(B) a fine under this title or imprisonment for not more than twenty years, or both, in the case of an
offense under subsection (a)(1) of this section which occurs after a conviction for another offense under
this section, or an attempt to commit an offense punishable under this subparagraph;
(2)(A) except as provided in subparagraph (B), a fine under this title or imprisonment for not more than
one year, or both, in the case of an offense under subsection (a)(2), (a)(3), or (a)(6) of this section which
does not occur after a conviction for another offense under this section, or an attempt to commit an offense
punishable under this subparagraph;
(B) a fine under this title or imprisonment for not more than 5 years, or both, in the case of an offense
under subsection (a)(2), or an attempt to commit an offense punishable under this subparagraph, if—
(i) the offense was committed for purposes of commercial advantage or private financial gain;
(ii) the offense was committed in furtherance of any criminal or tortious act in violation of the
Constitution or laws of the United States or of any State; or
(iii) the value of the information obtained exceeds $5,000; and
(C) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense
under subsection (a)(2), (a)(3) or (a)(6) of this section which occurs after a conviction for another offense
under this section, or an attempt to commit an offense punishable under this subparagraph;
(3)(A) a fine under this title or imprisonment for not more than five years, or both, in the case of an
offense under subsection (a)(4) or (a)(7) of this section which does not occur after a conviction for another
offense under this section, or an attempt to commit an offense punishable under this subparagraph; and
(B) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense
under subsection (a)(4) or (a)(7) of this section which occurs after a conviction for another offense under
this section, or an attempt to commit an offense punishable under this subparagraph;
(4)(A) except as provided in subparagraphs (E) and (F), a fine under this title, imprisonment for not
more than 5 years, or both, in the case of—
(i) an offense under subsection (a)(5)(B), which does not occur after a conviction for another offense
under this section, if the offense caused (or, in the case of an attempted offense, would, if completed,
have caused)—
(I) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation,
prosecution, or other proceeding brought by the United States only, loss resulting from a related
course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in
value;
(II) the modification or impairment, or potential modification or impairment, of the medical
examination, diagnosis, treatment, or care of 1 or more individuals;
(III) physical injury to any person;
(IV) a threat to public health or safety;
(V) damage affecting a computer used by or for an entity of the United States Government in
furtherance of the administration of justice, national defense, or national security; or
(VI) damage affecting 10 or more protected computers during any 1-year period; or
(ii) an attempt to commit an offense punishable under this subparagraph;
(B) except as provided in subparagraphs (E) and (F), a fine under this title, imprisonment for not more
than 10 years, or both, in the case of—
(i) an offense under subsection (a)(5)(A), which does not occur after a conviction for another offense
under this section, if the offense caused (or, in the case of an attempted offense, would, if completed,
have caused) a harm provided in subclauses (I) through (VI) of subparagraph (A)(i); or
(ii) an attempt to commit an offense punishable under this subparagraph;
(C) except as provided in subparagraphs (E) and (F), a fine under this title, imprisonment for not more
than 20 years, or both, in the case of—
(i) an offense or an attempt to commit an offense under subparagraphs (A) or (B) of subsection (a)(5)
that occurs after a conviction for another offense under this section; or
(ii) an attempt to commit an offense punishable under this subparagraph;
(D) a fine under this title, imprisonment for not more than 10 years, or both, in the case of—
Congressional Research Service
82

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

(i) an offense or an attempt to commit an offense under subsection (a) (5)(C) that occurs after a
conviction for another offense under this section; or
(ii) an attempt to commit an offense punishable under this subparagraph;
(E) if the offender attempts to cause or knowingly or recklessly causes serious bodily injury from
conduct in violation of subsection (a)(5)(A), a fine under this title, imprisonment for not more than 20
years, or both;
(F) if the offender attempts to cause or knowingly or recklessly causes death from conduct in violation
of subsection (a)(5)(A), a fine under this title, imprisonment for any term of years or for life, or both; or
(G) a fine under this title, imprisonment for not more than 1 year, or both, for—
(i) any other offense under subsection (a)(5); or
(ii) an attempt to commit an offense punishable under this subparagraph.
[(5) Repealed.]

(d)(1) The United States Secret Service shall, in addition to any other agency having such authority, have
the authority to investigate offenses under this section.
(2) The Federal Bureau of Investigation shall have primary authority to investigate offenses under
subsection (a)(1) for any cases involving espionage, foreign counterintelligence, information protected
against unauthorized disclosure for reasons of national defense or foreign relations, or Restricted Data (as
that term is defined in section 11y of the Atomic Energy Act of 1954 (42 U.S.C. 2014(y)), except for
offenses affecting the duties of the United States Secret Service pursuant to section 3056(a) of this title.
(3) Such authority shall be exercised in accordance with an agreement which shall be entered into by the
Secretary of the Treasury and the Attorney General.

(e) As used in this section—
(1) the term “computer” means an electronic, magnetic, optical, electrochemical, or other high speed
data processing device performing logical, arithmetic, or storage functions, and includes any data storage
facility or communications facility directly related to or operating in conjunction with such device, but such
term does not include an automated typewriter or typesetter, a portable hand held calculator, or other
similar device;
(2) the term “protected computer” means a computer—
(A) exclusively for the use of a financial institution or the United States Government, or, in the case
of a computer not exclusively for such use, used by or for a financial institution or the United States
Government and the conduct constituting the offense affects that use by or for the financial institution
or the Government; or
(B) which is used in or affecting interstate or foreign commerce or communication, including a
computer located outside the United States that is used in a manner that affects interstate or foreign
commerce or communication of the United States;
(3) the term “State” includes the District of Columbia, the Commonwealth of Puerto Rico, and any other
commonwealth, possession or territory of the United States;
(4) the term “financial institution” means—
(A) an institution, with deposits insured by the Federal Deposit Insurance Corporation;
(B) the Federal Reserve or a member of the Federal Reserve including any Federal Reserve Bank;
(C) a credit union with accounts insured by the National Credit Union Administration;
(D) a member of the Federal home loan bank system and any home loan bank;
(E) any institution of the Farm Credit System under the Farm Credit Act of 1971;
(F) a broker-dealer registered with the Securities and Exchange Commission pursuant to section 15
of the Securities Exchange Act of 1934;
(G) the Securities Investor Protection Corporation;
(H) a branch or agency of a foreign bank (as such terms are defined in paragraphs (1) and (3) of
section 1(b) of the International Banking Act of 1978); and
(I) an organization operating under section 25 or section 25(a) of the Federal Reserve Act;
(5) the term “financial record” means information derived from any record held by a financial institution
pertaining to a customer's relationship with the financial institution;
(6) the term “exceeds authorized access” means to access a computer with authorization and to use such
access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;
Congressional Research Service
83

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

(7) the term “department of the United States” means the legislative or judicial branch of the
Government or one of the executive departments enumerated in section 101 of title 5;
(8) the term “damage” means any impairment to the integrity or availability of data, a program, a
system, or information;
(9) the term “government entity” includes the Government of the United States, any State or political
subdivision of the United States, any foreign country, and any state, province, municipality, or other
political subdivision of a foreign country;
(10) the term “conviction” shall include a conviction under the law of any State for a crime punishable
by imprisonment for more than 1 year, an element of which is unauthorized access, or exceeding authorized
access, to a computer;
(11) the term “loss” means any reasonable cost to any victim, including the cost of responding to an
offense, conducting a damage assessment, and restoring the data, program, system, or information to its
condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred
because of interruption of service; and
(12) the term “person” means any individual, firm, corporation, educational institution, financial
institution, governmental entity, or legal or other entity.

(f) This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity
of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an
intelligence agency of the United States.

(g) Any person who suffers damage or loss by reason of a violation of this section may maintain a civil
action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A
civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set
forth in subclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i). Damages for a violation involving
only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages. No action may be
brought under this subsection unless such action is begun within 2 years of the date of the act complained
of or the date of the discovery of the damage. No action may be brought under this subsection for the
negligent design or manufacture of computer hardware, computer software, or firmware.

(h) The Attorney General and the Secretary of the Treasury shall report to the Congress annually, during
the first 3 years following the date of the enactment of this subsection, concerning investigations and
prosecutions under subsection (a)(5).

(i)(1) The court, in imposing sentence on any person convicted of a violation of this section, or convicted of
conspiracy to violate this section, shall order, in addition to any other sentence imposed and irrespective of
any provision of State law, that such person forfeit to the United States—
(A) such person's interest in any personal property that was used or intended to be used to commit or
to facilitate the commission of such violation; and
(B) any property, real or personal, constituting or derived from, any proceeds that such person
obtained, directly or indirectly, as a result of such violation.
(2) The criminal forfeiture of property under this subsection, any seizure and disposition thereof, and any
judicial proceeding in relation thereto, shall be governed by the provisions of section 413 of the
Comprehensive Drug Abuse Prevention and Control Act of 1970 (21 U.S.C. 853), except subsection (d) of
that section.

(j) For purposes of subsection (i), the following shall be subject to forfeiture to the United States and no
property right shall exist in them:
(1) Any personal property used or intended to be used to commit or to facilitate the commission of any
violation of this section, or a conspiracy to violate this section.
(2) Any property, real or personal, which constitutes or is derived from proceeds traceable to any
violation of this section, or a conspiracy to violate this section.

Congressional Research Service
84

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

18 U.S.C. 1956. Money Laundering (text)
(a)(1) Whoever, knowing that the property involved in a financial transaction represents the proceeds of
some form of unlawful activity, conducts or attempts to conduct such a financial transaction which in fact
involves the proceeds of specified unlawful activity B
(A)(i) with the intent to promote the carrying on of specified unlawful activity; or
(ii) with intent to engage in conduct constituting a violation of Section 7201 or 7206 of the Internal
Revenue Code of 1986; or
(B) knowing that the transaction is designed in whole or in part B
(i) to conceal or disguise the nature, the location, the source, the ownership, or the control of the
proceeds of specified unlawful activity; or
(ii) to avoid a transaction reporting requirement under State or Federal law,
shall be sentenced to a fine of not more than $500,000 or twice the value of the property involved in the
transaction, whichever is greater, or imprisonment for not more than twenty years, or both. For purposes of
this paragraph, a financial transaction shall be considered to be one involving the proceeds of specified
unlawful activity if it is part of a set of parallel or dependent transactions, any one of which involves the
proceeds of specified unlawful activity, and all of which are part of a single plan or arrangement.
(2) Whoever transports, transmits, or transfers, or attempts to transport, transmit, or transfer a monetary
instrument or funds from a place in the United States to or through a place outside the United States or to a
place in the United States from or through a place outside the United States—
(A) with the intent to promote the carrying on of specified unlawful activity; or
(B) knowing that the monetary instrument or funds involved in the transportation, transmission, or
transfer represent the proceeds of some form of unlawful activity and knowing that such transportation,
transmission, or transfer is designed in whole or in part—
(i) to conceal or disguise the nature, the location, the source, the ownership, or the control of the
proceeds of specified unlawful activity; or
(ii) to avoid a transaction reporting requirement under State or Federal law,
shall be sentenced to a fine of not more than $500,000 or twice the value of the monetary instrument or
funds involved in the transportation, transmission, or transfer whichever is greater, or imprisonment for not
more than twenty years, or both. For the purpose of the offense described in subparagraph (B), the
defendant’s knowledge may be established by proof that a law enforcement officer represented the matter
specified in subparagraph (B) as true, and the defendant’s subsequent statements or actions indicate that the
defendant believed such representations to be true.
(3) Whoever, with the intent B
(A) to promote the carrying on of specified unlawful activity;
(B) to conceal or disguise the nature, location, source, ownership, or control of property believed to
be the proceeds of specified unlawful activity; or
(C) to avoid a transaction reporting requirement under State or Federal law,
conducts or attempts to conduct a financial transaction involving property represented to be the proceeds of
specified unlawful activity, or property used to conduct or facilitate specified unlawful activity, shall be
fined under this title or imprisoned for not more than 20 years, or both. For purposes of this paragraph and
paragraph (2), the term “represented” means any representation made by a law enforcement officer or by
another person at the direction of, or with the approval of, a Federal official authorized to investigate or
prosecute violations of this section.

(b) Penalties.—
(1) In general.—Whoever conducts or attempts to conduct a transaction described in subsection (a)(1) or
(a)(3), or Section 1957, or a transportation, transmission, or transfer described in subsection (a)(2), is liable
to the United States for a civil penalty of not more than the greater of B
(A) the value of the property, funds, or monetary instruments involved in the transaction; or
(B) $10,000.
(2) Jurisdiction over foreign persons.—For purposes of adjudicating an action filed or enforcing a penalty
ordered under this section, the district courts shall have jurisdiction over any foreign person, including any
financial institution authorized under the laws of a foreign country, against whom the action is brought, if
Congressional Research Service
85

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

service of process upon the foreign person is made under the Federal Rules of Civil Procedure or the laws
of the country in which the foreign person is found, and—
(A) the foreign person commits an offense under subsection (a) involving a financial transaction that
occurs in whole or in part in the United States;
(B) the foreign person converts, to his or her own use, property in which the United States has an
ownership interest by virtue of the entry of an order of forfeiture by a court of the United States; or
(C) the foreign person is a financial institution that maintains a bank account at a financial institution
in the United States.
(3) Court authority over assets.—A court may issue a pretrial restraining order or take any other action
necessary to ensure that any bank account or other property held by the defendant in the United States is
available to satisfy a judgment under this section.
(4) Federal receiver.—
(A) In general.—A court may appoint a Federal Receiver, in accordance with subparagraph (B)
of this paragraph, to collect, marshal, and take custody, control, and possession of all assets of the
defendant, wherever located, to satisfy a civil judgment under this subsection, a forfeiture judgment
under Section 981 or 982, or a criminal sentence under Section 1957 or subsection (a) of this section,
including an order of restitution to any victim of a specified unlawful activity.
(B) Appointment and authority.—A Federal Receiver described in subparagraph (A)—
(i) may be appointed upon application of a Federal prosecutor or a Federal or State regulator, by
the court having jurisdiction over the defendant in the case;
(ii) shall be an officer of the court, and the powers of the Federal Receiver shall include the
powers set out in Section 754 of title 28, United States Code; and
(iii) shall have standing equivalent to that of a Federal prosecutor for the purpose of submitting
requests to obtain information regarding the assets of the defendant B
(I) from the Financial Crimes Enforcement Network of the Department of the Treasury; or
(II) from a foreign country pursuant to a mutual legal assistance treaty, multilateral
agreement, or other arrangement for international law enforcement assistance, provided that
such requests are in accordance with the policies and procedures of the Attorney General.

(c) As used in this section—
(1) the term “knowing that the property involved in a financial transaction represents the proceeds of
some form of unlawful activity” means that the person knew the property involved in the transaction
represented proceeds from some form, though not necessarily which form, of activity that constitutes a
felony under State, Federal, or foreign law, regardless of whether or not such activity is specified in
paragraph (7);
(2) the term “conducts” includes initiating, concluding, or participating in initiating, or concluding a
transaction;
(3) the term “transaction” includes a purchase, sale, loan, pledge, gift, transfer, delivery, or other
disposition, and with respect to a financial institution includes a deposit, withdrawal, transfer between
accounts, exchange of currency, loan, extension of credit, purchase or sale of any stock, bond, certificate of
deposit, or other monetary instrument, use of a safe deposit box, or any other payment, transfer, or delivery
by, through, or to a financial institution, by whatever means effected;
(4) the term “financial transaction” means (A) a transaction which in any way or degree affects interstate
or foreign commerce (i) involving the movement of funds by wire or other means or (ii) involving one or
more monetary instruments, or (iii) involving the transfer of title to any real property, vehicle, vessel, or
aircraft, or (B) a transaction involving the use of a financial institution which is engaged in, or the activities
of which affect, interstate or foreign commerce in any way or degree;
(5) the term “monetary instruments” means (i) coin or currency of the United States or of any other
country, travelers’ checks, personal checks, bank checks, and money orders, or (ii) investment securities or
negotiable instruments, in bearer form or otherwise in such form that title thereto passes upon delivery;
(6) the term “financial institution” includes B
(A) any financial institution, as defined in section 5312(a)(2) of title 31, United States Code, or the
regulations promulgated thereunder; and
(B) any foreign bank, as defined in section 1 of the International Banking Act of 1978 (12 U.S.C.
3101);
Congressional Research Service
86

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

(7) the term “specified unlawful activity” means B
(A) any act or activity constituting an offense listed in section 1961(1) of this title except an act
which is indictable under subchapter II of chapter 53 of title 31;
(B) with respect to a financial transaction occurring in whole or in part in the United States, an
offense against a foreign nation involving B
(i) the manufacture, importation, sale, or distribution of a controlled substance (as such term is
defined for the purposes of the Controlled Substances Act);
(ii) murder, kidnapping, robbery, extortion, destruction of property by means of explosive or
fire, or a crime of violence (as defined in Section 16);
(iii) fraud, or any scheme or attempt to defraud, by or against a foreign bank (as defined in
paragraph 7 of section 1(b) of the International Banking Act of 1978));
(iv) bribery of a public official, or the misappropriation, theft, or embezzlement of public funds
by or for the benefit of a public official;
(v) smuggling or export control violations involving—
(I) an item controlled on the United States Munitions List established under section 38 of
the Arms Export Control Act (22 U.S.C. 2778); or
(II) an item controlled under regulations under the Export Administration Regulations (15
C.F.R. Parts 730-774);
(vi) an offense with respect to which the United States would be obligated by a multilateral
treaty, either to extradite the alleged offender or to submit the case for prosecution, if the offender
were found within the territory of the United States; or
(vii) trafficking in persons, selling or buying of children, sexual exploitation of children, or
transporting, recruiting or harboring a person, including a child, for commercial sex acts;
(C) any act or acts constituting a continuing criminal enterprise, as that term is defined in section 408
of the Controlled Substances Act (21 U.S.C. 848);
(D) an offense under section 32 (the destruction of aircraft), section 37 (violence at international
airports), section 115 (influencing, impeding, or retaliating against a Federal official by threatening or
injuring a family member), section 152 (concealment of assets; false oaths and claims; bribery), section
175c (the variola virus), section 215 (commissions or gifts for procuring loans), section 351
(congressional or Cabinet officer assassination), any of sections 500 through 503 (certain
counterfeiting offenses), section 513 (securities of States and private entities), section 541 (goods
falsely classified), section 542 (entry of goods by means of false statements), section 545 (smuggling
goods into the United States), section 549 (removing goods from Customs custody), section 554
(smuggling goods from the United States), section 641 (public money, property, or records), section
656 (theft, embezzlement, or misapplication by bank officer or employee), section 657 (lending, credit,
and insurance institutions), section 658 (property mortgaged or pledged to farm credit agencies),
section 666 (theft or bribery concerning programs receiving Federal funds), section 793, 794, or 798
(espionage), section 831 (prohibited transactions involving nuclear materials), section 844(f) or (i)
(destruction by explosives or fire of Government property or property affecting interstate or foreign
commerce), section 875 (interstate communications), section 922(1) (the unlawful importation of
firearms), section 924(n) (firearms trafficking), section 956 (conspiracy to kill, kidnap, maim, or injure
certain property in a foreign country), section 1005 (fraudulent bank entries), 1006 (fraudulent Federal
credit institution entries), 1007 (fraudulent Federal Deposit Insurance transactions), 1014 (fraudulent
loan or credit applications), section 1030 (computer fraud and abuse), 1032 (concealment of assets
from conservator, receiver, or liquidating agent of financial institution), section 1111 (murder), section
1114 (murder of United States law enforcement officials), section 1116 (murder of foreign officials,
official guests, or internationally protected persons), section 1201 (kidnapping), section 1203 (hostage
taking), section 1361 (willful injury of Government property), section 1363 (destruction of property
within the special maritime and territorial jurisdiction), section 1708 (theft from the mail), section 1751
(Presidential assassination), section 2113 or 2114 (bank and postal robbery and theft), section 2252A
(child pornography) where the child pornography contains a visual depiction of an actual minor
engaging in sexually explicit conduct, section 2260 (production of certain child pornography for
importation into the United States), section 2280 (violence against maritime navigation), section 2281
(violence against maritime fixed platforms), section 2319 (copyright infringement), section 2320
(trafficking in counterfeit goods and services), section 2332 (terrorist acts abroad against United States
Congressional Research Service
87

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

nationals), section 2332a (use of weapons of mass destruction), section 2332b (international terrorist
acts transcending national boundaries), section 2332g (missile systems designed to destroy aircraft),
section 2332h (radiological dispersal devices), section 2339A or 2339B (providing material support to
terrorists), section 2339C (financing of terrorism), or section 2339D (receiving military-type training
from a foreign terrorist organization) of this title, section 46502 of title 49, United States Code, a
felony violation of the Chemical Diversion and Trafficking Act of 1988 (precursor and essential
chemicals), section 590 of the Tariff Act of 1930 (19 U.S.C. 1590) (aviation smuggling), section 422
of the Controlled Substances Act (transportation of drug paraphernalia), section 38(c) (criminal
violations) of the Arms Export Control Act, section 11 (violations) of the Export Administration Act of
1979, section 206 (penalties) of the International Emergency Economic Powers Act, section 16
(offenses and punishment) of the Trading with the Enemy Act, any felony violation of section 15 of the
Food and Nutrition Act of 2008 [7 U.S.C. 2024] (supplemental nutrition assistance program benefits
fraud) involving a quantity of benefits having a value of not less than $5,000, any violation of section
543(a)(1) of the Housing Act of 1949 [42 U.S.C. 1490s(a)(1)] (equity skimming), any felony violation
of the Foreign Agents Registration Act of 1938, any felony violation of the Foreign Corrupt Practices
Act, or section 92 of the Atomic Energy Act of 1954 (42 U.S.C. 2122) (prohibitions governing atomic
weapons)
ENVIRONMENTAL CRIMES
(E) a felony violation of the Federal Water Pollution Control Act (33 U.S.C. 1251 et seq.), the Ocean
Dumping Act (33 U.S.C. 1401 et seq.), the Act to Prevent Pollution from Ships (33 U.S.C. 1901 et
seq.), the Safe Drinking Water Act (42 U.S.C. 300f et seq.), or the Resources Conservation and
Recovery Act (42 U.S.C. 6901 et seq.); or
(F) any act or activity constituting an offense involving a Federal health care offense;
(8) the term “State” includes a State of the United States, the District of Columbia, and any
commonwealth, territory, or possession of the United States.
(9) the term “proceeds” means any property derived from or obtained or retained, directly or indirectly,
through some form of unlawful activity, including the gross receipts of such activity.

(d) Nothing in this section shall supersede any provision of Federal, State, or other law imposing criminal
penalties or affording civil remedies in addition to those provided for in this section.

(e) Violations of this section may be investigated by such components of the Department of Justice as the
Attorney General may direct, and by such components of the Department of the Treasury as the Secretary
of the Treasury may direct, as appropriate, and, with respect to offenses over which the Department of
Homeland Security has jurisdiction, by such components of the Department of Homeland Security as the
Secretary of Homeland Security may direct, and, with respect to offenses over which the United States
Postal Service has jurisdiction, by the Postal Service. Such authority of the Secretary of the Treasury, the
Secretary of Homeland Security, and the Postal Service shall be exercised in accordance with an agreement
which shall be entered into by the Secretary of the Treasury, the Secretary of Homeland Security, the Postal
Service, and the Attorney General. Violations of this section involving offenses described in paragraph
(c)(7)(E) may be investigated by such components of the Department of Justice as the Attorney General
may direct, and the National Enforcement Investigations Center of the Environmental Protection Agency.

(f) There is extraterritorial jurisdiction over the conduct prohibited by this section if—
(1) the conduct is by a United States citizen or, in the case of a non-United States citizen, the conduct
occurs in part in the United States; and
(2) the transaction or series of related transactions involves funds or monetary instruments of a value
exceeding $10,000.

(g) Notice of conviction of financial institutions.—If any financial institution or any officer, director, or
employee of any financial institution has been found guilty of an offense under this section, section 1957 or
1960 of this title, or section 5322 or 5324 of title 31, the Attorney General shall provide written notice of
such fact to the appropriate regulatory agency for the financial institution.

Congressional Research Service
88

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

(h) Any person who conspires to commit any offense defined in this section or section 1957 shall be subject
to the same penalties as those prescribed for the offense the commission of which was the object of the
conspiracy.

(i) Venue.—(1) Except as provided in paragraph (2), a prosecution for an offense under this section or
section 1957 may be brought in—
(A) any district in which the financial or monetary transaction is conducted; or
(B) any district where a prosecution for the underlying specified unlawful activity could be brought,
if the defendant participated in the transfer of the proceeds of the specified unlawful activity from that
district to the district where the financial or monetary transaction is conducted.
(2) A prosecution for an attempt or conspiracy offense under this section or section 1957 may be brought
in the district where venue would lie for the completed offense under paragraph (1), or in any other district
where an act in furtherance of the attempt or conspiracy took place.
(3) For purposes of this section, a transfer of funds from 1 place to another, by wire or any other means,
shall constitute a single, continuing transaction. Any person who conducts (as that term is defined in
subsection (c)(2)) any portion of the transaction may be charged in any district in which the transaction
takes place.

Congressional Research Service
89

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

18 U.S.C. 1961(1). RICO Predicate Offenses (text)
As used in this chapter –
(1) “racketeering activity means (A) any act or threat involving murder, kidnapping, gambling, arson,
robbery, bribery, extortion, dealing in obscene matter, or dealing in a controlled substance or listed
chemical (as defined in section 102 of the Controlled Substances Act), which is chargeable under State law
and punishable by imprisonment for more than one year;
(B) any act which is indictable under any of the following provisions of title 18, United States Code:
section 201 (bribery), section 224 (sports bribery), sections 471, 472, and 473 (counterfeiting), section 659
(theft from interstate shipment) if the act indictable under section 659 is felonious, section 664
(embezzlement from pension and welfare funds), sections 891-894 (extortionate credit transactions),
section 1028 (fraud and related activity in connection with identification documents), section 1029 (fraud
and related activity in connection with access devices), section 1084 (the transmission of gambling
information), section 1341 (mail fraud), section 1343 (wire fraud), section 1344 (financial institution
fraud), section 1425 (the procurement of citizenship or nationalization unlawfully), section 1426 (the
reproduction of naturalization or citizenship papers), section 1427 (the sale of naturalization or citizenship
papers), sections 1461-1465 (obscene matter), section 1503 (obstruction of justice), section 1510
(obstruction of criminal investigations), section 1511 (the obstruction of State or local law enforcement),
section 1512 (tampering with a witness, victim, or an informant), section 1513 (retaliating against a
witness, victim, or an informant), section 1542 (false statement in application and use of passport), section
1543 (forgery or false use of passport), section 1544 (misuse of passport), section 1546 (fraud and misuse
of visas, permits, and other documents), sections 1581-1592 (peonage, slavery, and trafficking in persons),
section 1951 (interference with commerce, robbery, or extortion), section 1952 (racketeering), section 1953
(interstate transportation of wagering paraphernalia), section 1954 (unlawful welfare fund payments),
section 1955 (the prohibition of illegal gambling businesses), section 1956 (the laundering of monetary
instruments), section 1957 (engaging in monetary transactions in property derived from specified unlawful
activity), section 1958 (use of interstate commerce facilities in the commission of murder-for-hire), section
1960 (illegal money transmitters), sections 2251, 2251A, 2252, and 2260 (sexual exploitation of children),
sections 2312 and 2313 (interstate transportation of stolen motor vehicles), sections 2314 and 2315
(interstate transportation of stolen property), section 2318 (trafficking in counterfeit labels for
phonorecords, computer programs or computer program documentation or packaging and copies of motion
pictures or other audiovisual works), section 2319 (criminal infringement of a copyright), section 2319A
(unauthorized fixation of and trafficking in sound recordings and music videos of live musical
performances), section 2320 (trafficking in goods or services bearing counterfeit marks), section 2321
(trafficking in certain motor vehicles or motor vehicle parts), sections 2341-2346 (trafficking in contraband
cigarettes), sections 2421-24 (white slave traffic), sections 175-178 (biological weapons), sections 229-
229F (chemical weapons), section 831 (nuclear materials),
(C) any act which is indictable under title 29, United States Code, section 186 (dealing with restrictions
on payments and loans to labor organizations) or section 501(c) (embezzlement from union funds),
(D) any offense involving fraud connected with a case under title 11 (except a case under Section 157 of
this title), fraud in the sale of securities, or the felonious manufacture, importation, receiving, concealment,
buying, selling, or otherwise dealing in a controlled substance or listed chemical (as defined in section 102
of the Controlled Substances Act), punishable under any law of the United States,
(E) any act which is indictable under the Currency and Foreign Transactions Reporting Act,
(F) any act which is indictable under the Immigration and Nationality Act, section 274 (bringing in and
harboring certain aliens), section 277 (aiding or assisting certain aliens to enter the United States), or
section 278 (importation of alien for immoral purpose) if the act indictable under such section of such Act
was committed for the purpose of financial gain, or
(G) any act that is indictable under any provision listed in section 2332b(g)(5)(B).

Congressional Research Service
90

.
Cybercrime: An Overview of 18 U.S.C. 1030 and Related Federal Criminal Laws

18 U.S.C. 2332b(g)(5)(B). Federal Crimes of
Terrorism (text)
(g) Definitions—As used in this section—
* * *
(5) the term “Federal crime of terrorism” means an offense that ...
(B) is a violation of—
(i) section 32 (destruction of aircraft or aircraft facilities), 37 (violence at international airports), 81 (arson
within special maritime and territorial jurisdiction), 175 or 175b (biological weapons), 175c (variola virus),
229 (chemical weapons), subsection (a), (b), (c), or (d) of section 351 (congressional, cabinet, and Supreme
Court assassination and kidnapping), 831 (nuclear materials), 832 (participation in nuclear and weapons of
mass destruction threats to the United States) 842(m) or (n) (plastic explosives), 844(f)(2) or (3) (arson and
bombing of Government property risking or causing death), 844(i) (arson and bombing of property used in
interstate commerce), 930(c) (killing or attempted killing during an attack on a Federal facility with a
dangerous weapon), 956(a)(1) (conspiracy to murder, kidnap, or maim persons abroad), 1030(a)(1)
(protection of computers), 1030(a)(5)(A) resulting in damage as defined in 1030 (c)(4)(A)(i)(II) through
(VI)(protection of computers), 1114 (killing or attempted killing of officers and employees of the United
States), 1116 (murder or manslaughter of foreign officials, official guests, or internationally protected
persons), 1203 (hostage taking), 1361 (government property or contracts), 1362 (destruction of
communication lines, stations, or systems), 1363 (injury to buildings or property within special maritime
and territorial jurisdiction of the United States), 1366(a) (destruction of an energy facility), 1751(a), (b),
(c), or (d) (Presidential and Presidential staff assassination and kidnapping), 1992 (terrorist attacks and
other acts of violence against railroad carriers and against mass transportation systems on land, on water, or
through the air), 2155 (destruction of national defense materials, premises, or utilities), 2156 (national
defense material, premises, or utilities), 2280 (violence against maritime navigation), 2281 (violence
against maritime fixed platforms), 2332 (certain homicides and other violence against United States
nationals occurring outside of the United States), 2332a (use of weapons of mass destruction), 2332b (acts
of terrorism transcending national boundaries), 2332f (bombing of public places and facilities), 2332g
(missile systems designed to destroy aircraft), 2332h (radiological dispersal devices), 2339 (harboring
terrorists), 2339A (providing material support to terrorists), 2339B (providing material support to terrorist
organizations), 2339C (financing of terrorism), 2339D (military-type training from a foreign terrorist
organization), or 2340A (torture) of this title;
(ii) sections 92 (prohibitions governing atomic weapons) or 236 (sabotage of nuclear facilities or fuel) of
the Atomic Energy Act of 1954 (42 U.S.C. 2122 or 2284);
(iii) section 46502 (aircraft piracy), the second sentence of section 46504 (assault on a flight crew with a
dangerous weapon), Section 46505(b)(3) or (c) (explosive or incendiary devices, or endangerment of
human life by means of weapons, on aircraft), section 46506 if homicide or attempted homicide is involved
(application of certain criminal laws to acts on aircraft), or section 60123(b) (destruction of interstate gas or
hazardous liquid pipeline facility) of title 49; or
(iv) section 1010A of the Controlled Substances Import and Export Act (narco-terrorism).

Author Contact Information

Charles Doyle

Senior Specialist in American Public Law
cdoyle@crs.loc.gov, 7-6968


Congressional Research Service
91