Cyber Trespassing Laws, Penalties, and How to Report It

Cyber trespassing laws make it a crime to access someone else’s computer, network, or online account without permission. At the federal level, the Computer Fraud and Abuse Act (CFAA) carries penalties from up to one year in prison for a basic first offense to as much as twenty years for the most serious violations, and victims can file their own civil lawsuits for money damages. Every state has its own computer crime statute on top of that, so a single act of unauthorized access can trigger liability in two systems at once.

What Counts as Cyber Trespassing

The violation is the unauthorized access itself. It doesn’t matter whether you took anything, changed anything, or even looked at anything sensitive. Common examples include:

Logging into another person’s email or social media without permission, whether by guessing a password, using a saved login on a shared device, or using credentials obtained through deception.
Connecting to a neighbor’s Wi-Fi without their knowledge or consent, even when the network has no password.
Reaching into parts of a workplace system an employee has no business viewing, such as a marketing employee pulling confidential HR records.
Installing spyware or a keylogger on someone’s phone or computer to monitor their activity.
Getting into a web server to change content, deface pages, or extract data.
Breaking into internet-connected cameras, smart locks, thermostats, or home assistants.

That last category catches people off guard. A smart doorbell or a voice assistant is a computer connected to a network, and federal prosecutors have treated unauthorized access to those devices the same as breaking into a corporate server.

The Federal Law That Applies

The main federal statute is the Computer Fraud and Abuse Act, at 18 U.S.C. § 1030. It prohibits intentionally accessing a protected computer without authorization, and it also prohibits accessing one with some authorization but reaching into areas that are off-limits.¹

“Protected computer” is defined so broadly that it covers virtually every device connected to the internet. A computer qualifies if it is used by the federal government, a financial institution, or is involved in interstate or foreign commerce or communication.¹ Because internet-connected devices communicate across state lines, the CFAA reaches personal laptops, phones, home networks, and smart devices as easily as it reaches corporate servers.

All 50 states, plus Puerto Rico and the U.S. Virgin Islands, also have computer crime laws that address unauthorized access.² A single intrusion can violate both.

When Misusing Access You Already Have Crosses the Line

One of the harder questions under the CFAA is where permission ends and trespass begins. The Supreme Court answered part of that question in Van Buren v. United States (2021). A police officer used his valid login credentials to search a law enforcement database for personal reasons, in violation of department policy. The question was whether misusing access you legitimately have counts as “exceeding authorized access” under the CFAA.³

The Court said no. You exceed authorized access only when you reach files, folders, or databases that are off-limits to you, not when you access permitted information for an unapproved purpose.³ The Court described this as a “gates-up-or-down” test: either you can get into a particular area of the system, or you cannot. If the gate is up and you walk through, the CFAA doesn’t ask why.

The practical effect shows up in workplaces. An employee who opens a coworker’s personnel file on a restricted drive has exceeded authorization. An employee who pulls their own sales data for a side project has misused information they were allowed to see, which may violate company policy or other laws but likely falls outside the CFAA after Van Buren.

Criminal Penalties

CFAA sentences depend on what was accessed, what the person intended to do, and whether they have a prior conviction. The same underlying act can range from a misdemeanor to a serious felony.

Simple unauthorized access with no aggravating factors, first offense: up to one year in prison.¹
Unauthorized access for commercial gain, in furtherance of another crime, or yielding information worth more than $5,000: up to five years.¹
Accessing a protected computer to commit fraud and obtaining something of value: up to five years for a first offense.¹
Unauthorized access to restricted government or national security data: up to ten years for a first offense, up to twenty for a second.¹
Intentionally transmitting malware or otherwise damaging a protected computer: up to five years for a first offense, or up to ten with certain aggravating factors. Reckless or negligent damage through unauthorized access carries lower penalties.¹
A prior CFAA conviction roughly doubles the maximum in nearly every category.

Fines come from the general federal sentencing statute rather than the CFAA. An individual convicted of a CFAA felony faces fines up to $250,000. For misdemeanor offenses that don’t result in death, the cap is $100,000.⁴

When a Victim Can Sue

Prosecution isn’t the only path. A victim can file a private civil lawsuit against the person responsible, seeking money damages and a court order to stop further intrusion.¹ Law enforcement doesn’t need to be involved; the victim files directly.

Not every CFAA violation supports a civil suit. The conduct must involve at least one of five factors: a loss of $5,000 or more within one year, an effect on medical care, physical injury to a person, a threat to public health or safety, or damage to a government computer used for national security or criminal justice.¹ The $5,000 loss threshold is the route most private plaintiffs use.

Courts can also issue injunctions ordering the trespasser to stop. That matters when the access is ongoing, such as a former employee whose credentials still work and who keeps logging in.

What Counts Toward the $5,000 Loss

The CFAA defines “loss” more narrowly than most people expect. It covers the reasonable cost of responding to the intrusion, doing a damage assessment, and restoring data or systems to their pre-intrusion state, plus revenue lost and other consequential damages caused by service interruptions.¹

Forensic investigators, staff time spent identifying what was accessed, and the expense of rebuilding compromised systems all count. So does lost revenue when the intrusion knocked a service offline. Business harm that isn’t tied to a service interruption generally doesn’t count. Courts have rejected losses from unfair competition, such as a competitor using stolen data to poach customers, because that harm isn’t tied to the computer system being impaired. The Supreme Court reinforced this narrow reading in Van Buren, noting that the CFAA’s loss definition “relates to costs caused by harm to computer data, programs, systems, or information services.”³

Deadlines to Act

A civil CFAA claim must be filed within two years. The clock starts on the date of the unauthorized access or the date the victim discovered the damage, whichever is later.¹ Discovery matters because many intrusions go undetected for months or years.

The CFAA itself sets no criminal statute of limitations. The general federal five-year limit typically applies, though national security offenses and certain other categories can carry longer windows. State computer crime laws have their own deadlines.

How to Report Cyber Trespassing

If you believe someone has accessed your computer or accounts without permission, the FBI’s Internet Crime Complaint Center is the central federal hub for cyber-related reports. File online at ic3.gov even if you’re unsure the activity is a federal offense.⁵ The information helps the FBI track trends, investigate cases, and in some situations recover stolen funds.

IC3 receives a very high volume of complaints and won’t respond directly to every one, but it shares reports with FBI field offices and law enforcement partners nationwide. Before filing, document everything: screenshots, access logs, timestamps, and any communications from the intruder. Specific evidence gives investigators something to work with.

Local law enforcement can also take reports, particularly when the conduct violates your state’s computer crime statute. If the access involves a workplace system, tell your employer’s IT security team right away so they can preserve server logs and shut down further access.

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
2
National Conference of State Legislatures. Computer Crime Statutes
3
Supreme Court of the United States. Van Buren v. United States
4
Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
5
Internet Crime Complaint Center. IC3 Home Page