Computer Fraud and Abuse Act (CFAA) Charges Under 18 U.S.C. § 1030, Explained

At the time of this writing, the Computer Fraud and Abuse Act, found at 18 U.S.C. § 1030, is generally the main federal law used to prosecute unauthorized access to computers, networks, and online accounts. It covers a range of conduct, from accessing an account or system without authorization to exceeding authorized access, damaging systems, trafficking in passwords, and computer-related extortion. Florida, Ohio, and North Carolina each have their own computer crime laws that cover similar conduct.

Attorney Ron Frey has practiced criminal defense since 2004 and is admitted in the Middle and Southern Districts of Florida, the Northern and Southern Districts of Ohio, and the Western and Eastern Districts of North Carolina. Drawing on his experience handling many computer crime cases, and years of teaching about computer crimes and computer evidence, he has found that these cases often turn on technical questions about authorization, access, and attribution. Because courts continue to reshape what “authorization” means, anyone facing these charges should talk with an attorney about the current state of the law.

What Is a CFAA or Computer Hacking Charge Generally?

Hacking charges generally involve accessing a computer, account, or network without permission, or going beyond the permission someone had. Many cases do not involve “hackers” in the movie sense. They often involve former employees who kept a login, people who accessed a partner’s or co-worker’s account, students, security researchers, or business disputes over data. Other cases involve ransomware, malware, or attacks on a company’s systems.

In a recent decision, the U.S. Supreme Court generally narrowed the “exceeds authorized access” part of the CFAA, and how that ruling applies continues to develop. This is one reason the specific facts about what access a person had, and how it was granted or revoked, matter so much.

State vs. Federal Hacking Cases

Federal CFAA prosecutions are generally more common when the conduct affected a business, a financial institution, a government system, or victims in multiple states, or when the FBI or Secret Service led the investigation. Cases involving access to a single person’s email or social media account are often prosecuted under state law. Some cases also come with civil lawsuits by employers or companies. See our post on computer and internet crimes in both state and federal court.

Common Evidence and How These Investigations Work

Hacking investigations typically rely on server and access logs, IP addresses, VPN and login records, device forensics, and records obtained from providers such as Google (see Google account evidence and email evidence). Logs can be incomplete, IP addresses can be shared or masked, and credentials can be used by more than one person. Increasingly, investigations also involve automated tools and AI agents acting on a user’s behalf, which raises new questions about who actually did what (see Agentic AI).

How Attorney Ron Frey Approaches Hacking Cases

Every case is different, but drawing on his experience handling many of these cases, Attorney Ron Frey generally looks closely at:

• Authorization. What access the person had, how it was granted, and whether and how it was revoked, including employment policies and terms of service.
• Attribution. Whether the logs and device evidence actually tie the person to the access.
• Loss and damage claims. How a company calculates its claimed loss, which can affect how a case is charged.
• Forensic methods. How the government collected and analyzed the digital evidence.
• The person’s background and intent. Many people charged have no record, and some believed they had permission. See our guide to a first-offense internet crime charge.

What to Do If Contacted by Federal Agents or Investigators

CFAA investigations often begin with a target letter, a visit from an FBI agent, or a search warrant for computers. Attorney Ron Frey generally suggests that anyone contacted about computer access invoke the right to remain silent and get legal advice before discussing passwords, accounts, or devices. Our posts on a federal target letter, providing passwords to the police or FBI, and what happens after police seize a computer explain more.

The Laws Involved

In the federal system, computer hacking cases are typically charged under 18 U.S.C. § 1030 (fraud and related activity in connection with computers), commonly called the Computer Fraud and Abuse Act. In Florida, similar conduct is generally addressed under the Florida Computer Crimes Act, including Section 815.06, Florida Statutes (offenses against users of computers, computer systems, computer networks, and electronic devices) and Section 815.04, Florida Statutes (offenses against intellectual property). In Ohio, these cases are typically charged under R.C. 2913.04 (unauthorized use of property – computer, cable, or telecommunication property), and in North Carolina under G.S. 14-454 (accessing computers) and G.S. 14-458 (computer trespass). As always, laws are subject to change and revision, so contact Attorney Ron Frey to discuss the details of your case and the current status of the law.

Why Talk With an Attorney About the Details?

A website can only offer a general picture. Computer crime law changes as technology changes, and court decisions continue to redefine terms like “authorization.” It is important to discuss the details of any specific situation with an attorney at the time it arises.

Talk With Attorney Ron Frey About a Computer Hacking Charge

If you are facing a CFAA or computer hacking charge, or are under investigation, contact Attorney Ron Frey of The Frey Law Firm, LLC. You can also read more about hacking charges.

This page is for general information only. It is not legal advice, and reading it or contacting us does not create an attorney-client relationship. Laws change, and how they apply depends on the facts of each case.