At the federal level, most offenders accused of cybercrimes are charged under the Computer Fraud and Abuse Act of 1986 (“CFAA”)  codified at 18 U.S.C § 1030.  This federal law criminalizes a  wide range of computer-related conduct such as the following:

• Computer trespassing (hacking),
• Damaging a government computer, bank computer or computer used in or affecting interstate commerce,
• Using a computer to commit a fraud where the computer belongs to the government, a bank or is used in, or affects, interstate commerce,
• Threatening to damage a government computer, bank computer or one used in or affecting interstate commerce,
• Trafficking in passwords for a government computer or when the trafficking affects interstate or foreign commerce, and
• Accessing a computer to commit espionage.    

The individual most credited with causing this federal law to be put into place, is Kevin Mitnick, who at just seventeen years old allegedly broke into the North American Aerospace Defense Command (NORAD) computer in 1981.  Mitnick is the first alleged “hacker” to make the FBI’s Most Wanted List.

The CFAA forbids unauthorized access, use, or distribution of any information:

(1) Related to national security,

(2) Financial records belong to financial institutions, including credit card companies,

(3) Any information belonging to any U.S. Department or Agency, or

(4) Related to foreign or interstate commerce or communication. 

With respect to cases in which fraud is alleged, the CFAA’s use of the term “protected computer” has been widely interpreted to include any computer connected to the internet and not just a government computer.  Similarly, the term “without authorization” employed under CFAA has been interpreted by the federal courts very broadly to encompass activities that exceeds the user’s authorization or for any improper purpose.  These interpretations have led to criticisms of the law’s potentially broad application.

A good example illustrating how the CFAA can be applied broadly can be found in the case of United States v. Nosal.  In that case, a former corporate recruiter was prosecuted for asking an employee at his former employer to share her password and login credentials so that, according to the government, either he or his co-conspirators could access his former employer’s database.  The defendant, David Nosal, was prosecuted for obtaining a former colleague’s computer password that allegedly allowed him access to his former employer’s computer database.  This case demonstrates how the CFAA can be applied very broadly to cover activities that many might not realize even constitute federal crimes.

In addition to the CFFA, there are other federal laws the government uses with frequency to prosecute people for activities involving computers and other forms of technology.  Federal law, 18 U.S.C. § 2261A,  prohibits a person from “stalking” (conduct that is meant to injure, harass or intimidate another).  The federal extortion statute, 18 U.S.C. § 825, prohibits extortionate threats to physically harm another or obtain a thing of value (i.e. money).  And, 47 U.S.C. § 223 criminalizes obscene and threatening communications.

The federal government also enacted the Electronic Communications Privacy Act of 1986 (“ECPA”), 18 U.S.C. § 2511, which covers data stored on and transferred from and between computer systems. The ECPA prohibits illegal use or interception of wire, oral or electronic  communications, which includes data sent over the internet. It also protects messages that are archived and stored, such as e-mail servers.  Similarly, federal statute 18 U.S.C. § 2701 makes it a federal crime to unlawfully access stored communications.     

Finally, the CAN-SPAM Act is a federal law that is intended to impose civil and criminal penalties on persons who send large amounts of unsolicited commercials emails (“spam”).  Running afoul of this statute can result in serious penalties.