The Computer Fraud and Abuse Act was written in 1986 to punish hackers breaking into government mainframes. Four decades later, it is the statute federal prosecutors reach for against a very different population: the software engineer who downloaded files before resigning, the IT administrator whose credentials still worked after termination, the founder whose company scraped a competitor’s website, and the security researcher who found a flaw and reported it. In a county whose economy runs on technology companies, medical systems, and financial firms, CFAA exposure sits inside ordinary workplace behavior, and most of the people charged under 18 U.S.C. § 1030 at the Federal Court in Santa Ana never imagined their conduct was criminal. The good news for the accused: the U.S. Supreme Court dramatically narrowed this statute in 2021, and much of what prosecutors once charged under it is no longer a federal crime at all.

What the Statute Prohibits

Section 1030 criminalizes accessing a computer without authorization, or exceeding authorized access, and its subsections cover the modern waterfront of computer crimes. The most commonly charged provision punishes obtaining information from a protected computer through unauthorized access. Others punish access in furtherance of fraud, knowingly transmitting code or commands that cause damage, the classic hacking and malware provision, trafficking in passwords, and transmitting extortionate threats to damage computers, the ransomware provision.

Two definitions give the statute its reach. A protected computer includes any computer used in or affecting interstate commerce, which courts have read to cover essentially every device connected to the internet. And loss, the gateway to felony treatment and civil liability under the statute’s $5,000 threshold, is defined around the costs of responding to and investigating an incident, a definition both sides fight over in nearly every case.

Penalties scale with the provision and the allegations. Simple unauthorized access to information can be a misdemeanor, but it becomes a felony carrying up to five years when committed for commercial advantage, in furtherance of another crime, or where the value exceeds $5,000. Access with intent to defraud carries five years, damage offenses carry ten, and prior convictions double the maximums. Because the conduct almost always involves interstate wires, wire fraud counts, with their twenty year ceilings, ride alongside, and where company data is involved, trade secret theft charges join them. The CFAA count is rarely alone; it is the anchor of a stack.

Van Buren: The Decision That Rewrote the Statute

For decades, prosecutors and employers argued that exceeds authorized access meant using access you legitimately had for a purpose your employer or a website prohibited: violating a computer use policy, breaching terms of service, taking data you were allowed to view but not allowed to take. Under that theory, millions of ordinary people committed federal crimes daily.

In Van Buren v. United States, the Supreme Court rejected it. The Court adopted a gates up or gates down approach: a person exceeds authorized access only by entering areas of a computer, files, folders, databases, that are off limits to them. A person who accesses information they are entitled to access, even for a disloyal, prohibited, or improper purpose, does not violate the CFAA. Misusing data you were allowed to reach may breach a contract, violate a policy, or support a trade secrets claim, but it is not a federal computer crime. The Ninth Circuit, whose law governs Orange County cases, has pushed in the same direction, holding that scraping publicly available websites is not access without authorization, because no gate was ever down.

For defendants, Van Buren is the first question in every case: what gate, exactly, does the government claim was closed, and how was the defendant supposed to know it? Cases built on policies rather than technical barriers, on ambiguous revocations, and on purpose based theories of misuse are cases built on the theory the Supreme Court killed.

Who Gets Charged, and the Defenses That Work

The modern CFAA docket is dominated by employment separations and business disputes, which means these prosecutions often begin as civil fights, a demand letter, an employer’s forensic audit, a competitor’s lawsuit, that a referral converts into a criminal case. That origin is itself defense material: the complaining witness is frequently a company with financial motives, litigation strategy, and its own conduct to explain.

The core defenses track the statute’s weak points. Authorization: the defendant’s credentials worked, no technical barrier was crossed, and the government’s theory reduces to disapproved purpose, which Van Buren forecloses. Notice and revocation: where access was supposedly cut off, when and how the defendant was told matters, and ambiguity defeats the required intent. Attribution: as in every digital case, logs identify accounts and addresses, not fingers on keyboards, and shared credentials, service accounts, and remote access complicate the government’s identification, issues explored in our article on how digital evidence is challenged. Loss: response costs are litigated line by line, because below $5,000 the felony theory and the civil claim both fail. And for researchers, the Department of Justice announced in 2022 that good faith security research, accessing systems to identify and disclose vulnerabilities without harm, should not be charged, a policy that careful counsel invokes early and in writing.

One warning belongs in every conversation about these cases: CFAA investigations begin with interviews, and tech professionals, confident they can explain the logs, talk. The false statement statute converts those explanations into independent felonies, a danger covered in our article on lying to federal agents. The logs will still be there after you retain counsel. Your words cannot be taken back.

The State Court Shadow: California Penal Code 502

Federal exposure is only half the map. California maintains its own comprehensive computer crimes statute, Penal Code 502, and Orange County prosecutors file it regularly in cases the federal government declines. The state statute reaches knowingly accessing computers, systems, networks, or data without permission, along with taking, copying, altering, damaging, or disrupting them, and several of its provisions are drafted more broadly than the federal law, with without permission doing the work that authorization does in the CFAA.

For defendants this creates three practical realities. First, a matter turned away by federal prosecutors after Van Buren is not necessarily over; the same employer referral can resurface at the Orange County District Attorney’s Office under the state statute, where the doctrinal landscape differs. Second, the state statute is a wobbler in many of its forms, meaning outcomes range from misdemeanors to felony prison terms, and the charging decision is influenced by the early defense presentation in ways a silent defendant forfeits. Third, defending these matters requires counsel comfortable in both courthouses, because the declination fight in one system and the filing fight in the other happen simultaneously, on the same facts, sometimes in the same week. A lawyer who practices only federally, or only in state court, sees half the board.

Sentencing: Where CFAA Cases Are Really Decided

Because most charged CFAA cases resolve by plea, the sentencing framework deserves as much attention as the elements. Federal computer crimes sentences are driven by the fraud guideline, which means the loss figure controls nearly everything: each escalation of claimed loss ratchets the advisory range upward, and enhancements for sophisticated means, use of special skills, and abuse of a position of trust stack readily against technology professionals, whose ordinary job descriptions read like enhancement checklists to a probation officer. The defense sentencing fight therefore mirrors the liability fight: contesting the loss methodology line by line, resisting the characterization of routine technical competence as sophistication, and presenting the defendant, usually a first offender with a career, family, and no resemblance to the statute’s imagined hacker, through a full mitigation presentation under the sentencing factors. Restitution and the collateral consequences, professional licenses, security clearances, and industry reputation, are negotiated in the same breath. Handled well, many of these cases end without custody. Handled passively, the guidelines arithmetic does the sentencing.

Five Examples of CFAA Defense in Practice

Example 1: The departing engineer. Before resigning, an Irvine engineer downloads project files using her own credentials from folders she used daily. Her former employer refers the matter federally. Under Van Buren, no gate was down: she accessed what she was entitled to access, and the criminal theory fails, leaving the dispute where it belongs, in civil court.

Example 2: The administrator after termination. An IT administrator logs into a former employer’s system a week after termination using credentials nobody disabled. The danger zone is real, but the defense develops the offboarding chaos: no revocation notice, an email asking him to assist the transition, and continued access by design. Intent to access without authorization fails.

Example 3: The scraper. A startup gathers pricing data from a competitor’s public website, and the competitor pushes for prosecution. Ninth Circuit law holds public data carries no authorization gate, the criminal referral dies, and the fight proceeds, if at all, as a business tort case.

Example 4: The researcher. A security consultant discovers a vulnerability exposing patient records, reports it to the company, and receives a visit from agents instead of thanks. Counsel invokes the good faith research policy with documentation of the disclosure and the absence of harm, and no charges are filed.

Example 5: The loss number that collapsed. A company claims $80,000 in losses from a former employee’s access, built on executive time and consultant invoices for a systemwide audit it planned anyway. The defense dismantles the calculation to under $5,000 of genuine response cost, the felony becomes untenable, and the case resolves as a misdemeanor with no custody.

Ten Frequently Asked Questions

What is the Computer Fraud and Abuse Act? The federal statute, 18 U.S.C. § 1030, criminalizes access to computers without authorization or in excess of authorization, along with computer damage, password trafficking, and ransomware-style extortion. It anchors most federal computer crimes prosecutions.

Is violating a website’s terms of service a federal crime? After Van Buren, generally no. Breaching terms of service or use policies with access you legitimately have is not a CFAA violation, though it can still create civil exposure.

Can I be charged for taking files from my own work account? Not under the CFAA if you were entitled to access them, even if taking them violated policy. Trade secret and civil claims are a separate question, which is why these cases need counsel fluent in both.

What does exceeds authorized access mean now? Entering parts of a system that are off limits to you, gates down. Misusing information from areas you were allowed to enter does not qualify.

What is a protected computer? Practically any computer connected to the internet, so the element rarely provides a defense. The fight is over authorization, intent, and loss instead.

What are the penalties for a CFAA conviction? They range from misdemeanors to ten years or more depending on the provision, with felony treatment triggered by fraud, damage, or losses over $5,000, and wire fraud counts often stacked alongside.

What counts toward the $5,000 loss threshold? Reasonable costs of responding to and investigating the incident. Inflated audits, wish list upgrades, and litigation expenses are challenged line by line, and defeating the threshold defeats the felony.

Can a company sue me and push criminal charges at the same time? Yes, and it happens constantly. Parallel civil and criminal exposure requires coordinated strategy, because statements and productions in the lawsuit flow into the prosecution.

Is security research legal? The Justice Department’s charging policy directs that good faith security research, done to identify and disclose vulnerabilities without harm, should not be prosecuted. Documentation of good faith is the researcher’s shield, and counsel should assert it early.

What should I do if agents contact me about computer access? Decline the interview politely, preserve every device and account exactly as they are, and retain counsel before responding to anything. Explanations given without counsel become false statement charges, and deletion becomes obstruction.

Contact an Orange County Criminal Defense Attorney for CFAA Charges

Computer crimes prosecutions are white-collar crime cases with a technical spine, and they are won by counsel who can litigate authorization doctrine, loss calculations, and forensic attribution while managing the parallel civil war. Attorney John D. Rogers is a board-certified criminal law specialist who defends federal cases, including white-collar crimes and computer crimes matters, at the Federal Court in Santa Ana and in the federal courts of Los Angeles and Riverside, from the first agent contact through federal plea agreements and trial.

Contact the Law Offices of John D. Rogers today if you’re seeking representation from an experienced Orange County criminal defense attorney.

Follow for legal insights: YouTube @Johndrogerslaw · TikTok @johndrogers · Instagram @johndrogerslaw · Twitter/X @johndrogerslaw · Law Offices of John D. Rogers on LinkedIn