Federal computer fraud and hacking charges

What does federal law make illegal?

The main federal hacking law is 18 U.S.C. § 1030. It has seven offenses in subsection (a). Four of them come up most often in criminal cases. Each one turns on access: either getting into a computer "without authorization," or "exceeding authorized access," which means using permission you have to reach information you are not entitled to get (§ 1030(e)(6)).

• Taking information (§ 1030(a)(2)). Intentionally accessing a computer without authorization, or exceeding authorized access, and getting information from it. This covers financial and credit-report records, information from a federal agency, and information from any "protected computer."
• Fraud (§ 1030(a)(4)). Knowingly, and with intent to defraud, accessing a protected computer without authorization or exceeding authorized access, and by doing so furthering the fraud and getting something of value. Using the computer alone is not enough if its value was $5,000 or less in a year.
• Damage (§ 1030(a)(5)). Knowingly sending a program, code or command that intentionally damages a protected computer, such as ransomware or malware. It also covers someone who gets in without authorization and then recklessly causes damage, or causes damage and loss. "Damage" means harm to the integrity or availability of data, a program, a system or information (§ 1030(e)(8)).
• Extortion (§ 1030(a)(7)). Sending a threat to damage a protected computer, to take or expose its information, or demanding payment to fix damage the sender caused, in order to extort money or anything else of value.

A "protected computer" includes a computer used by a bank or the federal government, and any computer "used in or affecting interstate or foreign commerce or communication" (§ 1030(e)(2)). That wording can cover ordinary business and personal devices connected to the internet. Trying or agreeing to commit any of these offenses carries the same penalty as the offense itself (§ 1030(b)).

This page focuses on what happens when you or someone you love is investigated or charged, and how these cases are defended. For a longer explainer on the statute itself, its history and its definitions, see Federal cyber crimes at BrandonSample.com. For related fraud charges, see our white-collar crime defense guide.

What are the penalties?

The maximum depends on the subsection and on whether the person has a prior conviction under § 1030 (18 U.S.C. § 1030(c)).

• Mandatory minimum: none under § 1030. A companion § 1028A count adds a mandatory 2 years that must run consecutively.
• Fine: for an individual, up to $250,000 for a felony or $100,000 for a Class A misdemeanor, or up to twice the gross gain or twice the gross loss, whichever is greater (18 U.S.C. § 3571(b), (d)).
• Forfeiture: the court must order forfeiture of personal property used to commit the offense, such as computers and phones, and of any proceeds (§ 1030(i)).
• Restitution: the court can order the person to pay victims' losses and, for many fraud and property offenses, must (18 U.S.C. § 3663A).
• Supervised release: up to 3 years for a 5-, 10- or 20-year felony, and up to 1 year for a misdemeanor (18 U.S.C. §§ 3559(a), 3583(b)).
• Civil lawsuits: a victim can also sue under § 1030(g) in some cases, so a criminal case may run alongside a civil one.

How does sentencing work for this charge?

The judge first works out the range under the federal Sentencing Guidelines, then weighs the factors in 18 U.S.C. § 3553(a). The Commission's Statutory Index (Appendix A) assigns USSG §2B1.1 to the most common computer offenses: § 1030(a)(2), (a)(4), (a)(5) and (a)(6). Extortion under § 1030(a)(7) goes to §2B3.2, and an attempt or conspiracy under § 1030(b) goes to §2X1.1.

Under §2B1.1 the base offense level is 6, because these offenses carry less than 20 years. Levels are then added for loss under the loss table. In a § 1030 case, loss includes the victim's reasonable costs of responding to the offense, assessing the damage and restoring data or systems, plus revenue lost because service was interrupted, even if those costs weren't foreseeable (§2B1.1, Application Note 3(A)(iii)). §2B1.1 also has increases for § 1030 offenses that involved an intent to obtain personal information, damage under § 1030(a)(5)(A), or computers that run critical infrastructure or serve the courts, national defense or national security (§2B1.1(b)(18), (b)(19)).

For how the loss table and the rest of the guideline math work, see the Sentencing.net links below, including what the 2026 amendments change for fraud loss.

Pending at the Supreme Court. In Beaird v. United States, No. 25-5343, set for argument on October 13, 2026, the Court agreed to decide whether Stinson v. United States (1993) still states the rule for how much weight courts must give the Guidelines’ commentary, the notes that follow each guideline. The answer could affect rules on this page that come from commentary rather than from the guideline text itself.

Guideline numbers on this page are from the Guidelines Manual in effect since November 1, 2025, which no longer uses “departures”: the judge calculates the range, then weighs the factors in 18 U.S.C. § 3553(a). For more depth, see How the federal Sentencing Guidelines work, at Sentencing.net, a Criminal Center site.

Statutes covered on this page

Each federal law this page covers, listed by how often it was a statute of conviction in fiscal year 2025 (U.S. Sentencing Commission data). For each one: the official section heading, what the government must prove, the penalties, and the sentencing guideline the Commission's Statutory Index assigns to it. See all statutes by title and section.

• 18 U.S.C. § 1030

How do these cases usually start and move?

Before charges, the government often has months of records from the victim company and from service providers. Agents may ask the person for an interview during or after a search. Anything said can be used later, and a false answer can be charged on its own under 18 U.S.C. § 1001. Talking with a lawyer before answering questions is the safer course.

After charges, the government must share its evidence under Fed. R. Crim. P. 16, which in these cases usually means large volumes of forensic data. Many cases turn on a forensic examiner's review of that data and on the loss figure. For an overview of every stage, see what to do when facing federal charges.

The usual stages of a federal case

1. 1Investigation. Agents gather records and interview witnesses, often using grand jury subpoenas. Someone the prosecutor views as a "target" may get a target letter before an indictment; a "subject" is anyone whose conduct is within the scope of the grand jury's investigation (Justice Manual 9-11.151, 9-11.153).
2. 2Charges. A federal felony is usually charged by indictment: a grand jury decides in private whether there is probable cause (Fed. R. Crim. P. 6, 7). Some cases start with an arrest on a criminal complaint.
3. 3First appearance and detention. After an arrest, the person goes before a magistrate judge without unnecessary delay (Fed. R. Crim. P. 5). The judge decides whether they are released or held until trial (18 U.S.C. § 3142).
4. 4Evidence and motions. The government must turn over certain evidence (Fed. R. Crim. P. 16). The defense can ask the court to suppress evidence or dismiss charges (Fed. R. Crim. P. 12).
5. 5Plea or trial. Many federal cases end in a guilty plea, which the judge must find knowing and voluntary (Fed. R. Crim. P. 11). At trial, the government must prove every element beyond a reasonable doubt, and a jury verdict must be unanimous (Fed. R. Crim. P. 31(a)).
6. 6Sentencing. A probation officer writes a presentence report, and each side can object in writing within 14 days of receiving it (Fed. R. Crim. P. 32). The judge then decides the sentence under 18 U.S.C. § 3553(a).

More on what to do at each stage: Facing federal charges? What to do now.

What defense issues come up in these cases?

• Authorization. Did the person have permission to be where they were in the system? After Van Buren, misusing information you were allowed to reach is not "exceeding authorized access." What exactly was off-limits, and how was that limit set?
• Attribution. Who was at the keyboard? IP addresses, shared accounts, shared devices, VPNs and remote access can make it hard to tie activity to one person. The government must prove it was this person.
• Intent. Most subsections require intentional or knowing conduct, and (a)(4) requires intent to defraud. Was the conduct a mistake, a test, or a misunderstanding about what was allowed?
• Loss and damage. The loss figure can raise both the maximum and the guideline range. Were the claimed response costs reasonable, actually caused by the offense, and properly documented?
• The search. Did the warrant describe the devices and data with enough detail, and did the examiners stay within it? Were providers' records obtained with proper legal process?
• The forensic work. Can the defense examiner reproduce the government's findings from the same images? Are there other explanations for the data?
• Companion counts. Does an aggravated identity theft count meet the "crux" limit, and are wire fraud counts based on the same conduct?

Every case turns on its own facts. These are issues to look at, not predictions about how any case will turn out.

What happens after a conviction?

• Appeal. A notice of appeal is usually due within 14 days after the judgment is entered (Fed. R. App. P. 4(b)(1)(A)). Many plea agreements waive the right to appeal, but in Hunter v. United States (2026) the Supreme Court held that a waiver can’t be enforced when doing so would cause a miscarriage of justice, a high bar. See how federal criminal appeals work and federal appeals at Sentencing.net.
• A § 2255 motion. A motion asking the sentencing court to vacate, set aside or correct the sentence, for example for ineffective assistance of counsel. It is usually due within one year after the conviction becomes final (28 U.S.C. § 2255(f)). See 2255motion.com.
• Compassionate release. A motion asking the judge to reduce a prison sentence for extraordinary and compelling reasons, filed after the person asks the warden and either exhausts BOP appeals or waits 30 days (18 U.S.C. § 3582(c)(1)(A)). It can’t be used to attack the validity of the conviction itself (Fernandez v. United States (2026)). See CompassionateRelease.com.
• Clemency. The President can pardon a federal offense or commute (shorten) a federal sentence (U.S. Const. art. II, § 2). See Clemency.com.