In a federal computer case, the logs may show exactly when someone signed in, what account was used, and which files were opened. That does not settle the most important question: was the person allowed to reach that information at that time?
The answer may depend on a disabled account, a shared password, a former employee’s permissions, or the difference between breaking an access restriction and breaking a workplace rule. A dispute that looks technical is often decided by ordinary evidence about permission, knowledge, and intent.
Keith & Lorfing defends hardworking West Texans facing federal investigations and charges. If you are facing a subpoena, target letter, search warrant, agent interview, or another federal computer-crime inquiry, speak with a federal investigations defense lawyer before explaining system access, permissions, passwords, or intent to investigators.
What the CFAA actually prohibits
The Computer Fraud and Abuse Act is codified at 18 U.S.C. § 1030. It does not create one general crime called “hacking”; it covers several types of conduct involving computer access, information, fraud, damage, passwords, and extortion.
Each subsection has its own required mental state and other elements. The government must prove the offense it charged, not merely that the defendant used a computer in a way someone disliked.
What is a protected computer?
Many CFAA provisions apply to a “protected computer.” The definition includes computers used by or for certain financial institutions or the federal government, as well as computers used in or affecting interstate or foreign commerce or communication.
That commerce language gives the statute broad reach. In practice, internet-connected computers, servers, cloud systems, and other networked devices may satisfy the definition even when the dispute began inside a private business.
The seven categories in section 1030(a)
The following table is a plain-language overview. The precise wording of the charged subsection controls.
| Subsection | General subject | What distinguishes it |
|---|---|---|
| § 1030(a)(1) | Protected national-security information | Access, acquisition, and improper communication or retention of specified protected information |
| § 1030(a)(2) | Obtaining information | Intentional access without authorization, or exceeding authorized access, to obtain covered information |
| § 1030(a)(3) | Nonpublic federal computers | Intentional unauthorized access to specified federal computers |
| § 1030(a)(4) | Computer access in furtherance of fraud | Knowing unauthorized or excessive access, intent to defraud, furtherance of the fraud, and obtaining value |
| § 1030(a)(5) | Computer damage | Transmission or unauthorized access that causes damage, with the required mental state depending on the paragraph charged |
| § 1030(a)(6) | Password or access trafficking | Knowing trafficking with intent to defraud when the statutory jurisdictional requirement is met |
| § 1030(a)(7) | Computer-related extortion | Transmitting specified threats or demands with intent to extort |
A prosecutor cannot treat these theories as interchangeable. For example, an information-taking charge under § 1030(a)(2), a fraud charge under § 1030(a)(4), and a damage charge under § 1030(a)(5) require different proof.
“Without authorization” and “exceeds authorized access” are different
The CFAA uses two phrases that sound similar but address different situations. A person acts “without authorization” when the government claims the person had no permission to access the computer at all.
A person “exceeds authorized access” when access to the computer was authorized, but the person obtained or altered information he or she was not entitled to obtain or alter through that access. The second theory concerns restricted areas inside a system, such as another user’s account, a database, a folder, or a file.
This distinction can be decisive for employees, contractors, vendors, and other insiders. Having a working password is evidence, but it does not answer by itself whether access was authorized.
What Van Buren v. United States changed
In Van Buren v. United States, a police officer used valid credentials to search a law-enforcement database for an improper personal reason. He violated department policy, but he was entitled to obtain the database information through his account.
The Supreme Court held that he did not “exceed authorized access” under § 1030(a)(2). That phrase applies when someone accesses information in a part of the computer that is off-limits, not when someone obtains information available through authorized access but does so for an improper purpose.
The “gates-up-or-down” approach
The Court described authorization as a “gates-up-or-down” inquiry. A user either may or may not enter the computer, and may or may not enter a particular area within it.
That rule prevents a basic workplace-policy violation from automatically becoming a federal computer crime. Reading personal email on a work computer, using permitted information for a disapproved reason, or violating an official-use policy does not by itself prove that the user exceeded authorized access.
What the Supreme Court did not decide
Van Buren did not answer every authorization question. The Court expressly left open whether access gates must be technological, such as permissions created by code or system settings, or whether some limits in contracts and policies may also matter.
The decision also did not create a general rule legalizing password sharing, scraping, post-employment access, or copying company files. Those situations can turn on who had authority to grant permission, whether access had been revoked, which account or system area was entered, and what other federal or state laws apply.
The current DOJ charging policy is narrower than the statute’s broadest possible reading
The Department of Justice’s current CFAA charging policy instructs federal prosecutors not to bring an “exceeds authorized access” case unless the computer is divided into areas through code or configuration, the defendant could enter some areas but was unconditionally barred from others, and the defendant knowingly entered an off-limits area.
The policy also says prosecutors should not base a CFAA charge solely on violating a public website’s terms of service or an employer’s rule about how a work computer may be used. It directs prosecutors to decline a case when the evidence shows the conduct and intent consisted of good-faith security research as the policy defines it.
This policy is important, but it is not an amendment to § 1030 or a promise of immunity. Other statutes, civil claims, contracts, or state laws may still apply, and the facts must satisfy the policy’s requirements.
How federal computer investigations develop
A CFAA investigation may begin with an employer’s internal review, a civil complaint, a report to law enforcement, a cloud-provider record, or suspicious activity identified by a security team. Federal agents can then seek records from the company, service providers, devices, witnesses, and the person under investigation.
The first government contact may be a subpoena, search warrant, target letter, request for an interview, or visit from agents. The label on the document matters because each requires a different response.
Evidence that can show the boundaries of access
The defense must reconstruct permission as it existed at the exact time of the disputed activity. That often requires more than reading an employee handbook.
Relevant evidence may include:
Account permissions: role assignments, access-control lists, group membership, administrator rights, and changes to those settings.
Authorization history: contracts, written approvals, project assignments, manager instructions, and established working practices.
Offboarding records: termination dates, account-disable times, return-of-property records, and notices revoking access.
Authentication records: sign-in logs, multifactor prompts, password resets, VPN records, IP addresses, and device identifiers.
File activity: downloads, uploads, edits, deletions, sharing events, external-drive use, and cloud synchronization.
Communications: emails, messages, tickets, and meeting notes showing what access was requested, granted, questioned, or withdrawn.
Forensic evidence: device images, timestamps, metadata, browser artifacts, and records showing whether an automated process or a person caused the event.
One timestamp can change the analysis. Access before permission ended is not the same as access after an account was disabled, credentials were returned, or a clear revocation was received.
A working login does not necessarily equal permission
An account may remain technically active after authority ends because a company’s offboarding process was delayed. Conversely, an error message or blocked folder may result from configuration trouble rather than a deliberate access boundary.
That is why the government’s “the password worked” or “the system blocked the user” narrative must be compared with human evidence about authorization. Technical records show what the system did; they do not always show what the parties agreed.
How “damage” and “loss” work under the CFAA
The statute gives “damage” and “loss” specific meanings. They are not simply different words for the value of information taken.
Damage: an impairment to the integrity or availability of data, a program, a system, or information.
Loss: reasonable costs of responding to an offense, assessing damage, and restoring data or systems, plus revenue loss, costs, or other consequential damages caused by an interruption of service.
This distinction matters when an alleged victim submits incident-response bills, forensic expenses, downtime calculations, or lost-revenue figures. A large invoice is not automatically a legally valid CFAA loss.
The defense can examine whether the work was reasonably tied to the alleged offense, whether ordinary security upgrades were included, whether downtime actually occurred, and whether the claimed period matches the statutory time window.
The $5,000 threshold is not a universal element
The CFAA refers to an aggregate loss of at least $5,000 during a one-year period in several places, including one route to felony treatment and one route to a private civil action. That does not mean every CFAA offense requires proof of a $5,000 loss.
Section 1030 also identifies other harm factors, including effects on medical care, physical injury, threats to public health or safety, certain government systems, and damage affecting at least 10 protected computers in one year. The charged subsection and penalty provision must be read together.
Criminal penalties depend on the subsection and facts
There is no single sentence for a CFAA conviction. Exposure depends on the offense, the required mental state, the alleged purpose, resulting harm, prior qualifying convictions, and whether the government charges an attempt or conspiracy.
A first § 1030(a)(2) offense is generally a misdemeanor, but it can become a felony punishable by up to five years when it was committed for commercial advantage or private financial gain, in furtherance of another criminal or tortious act, or when the value of the information obtained exceeds $5,000. A later qualifying conviction can increase the maximum.
Other CFAA subsections carry their own maximum penalties, some substantially higher when serious injury, death, or other specified harm is involved. Sentencing after conviction also requires an advisory federal guideline calculation and consideration of the factors in 18 U.S.C. § 3553(a).
A CFAA dispute can create criminal and civil cases
Section 1030(g) allows a person who suffered damage or loss because of a CFAA violation to seek compensatory damages and injunctive or other equitable relief. A civil claim must involve at least one of the harm factors listed in the statute; it is not available merely because someone alleges an unauthorized login.
The Fifth Circuit has recognized that a civil action may be based on a violation outside § 1030(a)(5), as long as the required harm factor is present. A civil action generally must be filed within two years of the challenged act or discovery of the damage.
A company may therefore file suit while also making a criminal referral. Statements, declarations, discovery responses, and forensic positions taken in the civil case can affect the criminal investigation, so the two tracks should be evaluated together.
Other charges may accompany a CFAA allegation
Computer access may be only one part of the government’s theory. Depending on the evidence, prosecutors may consider mail fraud, federal wire fraud charges, trade-secret theft, identity offenses, extortion, money laundering, obstruction, conspiracy, or false statements.
The facts supporting those charges are not automatic simply because § 1030 appears in an indictment. For example, a fraud charge requires its own proof, and a trade-secret case requires the government to establish that the information legally qualifies and was misappropriated with the required intent.
Defense issues that can change a CFAA case
An effective review begins with the exact statutory language, then tests each element against the digital and human evidence. Common issues include:
No unauthorized access: the person had permission from someone authorized to grant it at the time.
No off-limits information: the user did not enter a restricted account, folder, database, or other system area.
Purpose confused with access: the accusation depends on an improper reason for viewing information the user was allowed to obtain.
Knowledge not proved: the evidence does not show the defendant knew the facts that made the access unauthorized.
Identity disputed: logs show an account or device, but do not reliably prove who performed the action.
Intent missing: the charged fraud, damage, trafficking, or extortion subsection requires a mental state the evidence does not establish.
Damage or loss overstated: claimed costs do not fit the statute’s definitions or were not caused by the alleged conduct.
Evidence is incomplete: missing logs, time-zone errors, shared accounts, automated syncing, or weak forensic methods undermine the timeline.
DOJ policy applies: the theory is based only on a use restriction, terms of service, or qualifying good-faith security research.
Some disputes remain serious even when the CFAA theory is weak. Trade-secret law, contract claims, privacy laws, or state computer-crime statutes may still require a separate defense.
What to do after receiving a subpoena, letter, or agent visit
The safest early response protects the evidence without creating new problems. Do not delete, alter, rename, move, or “clean up” files, accounts, messages, logs, or devices after learning about an investigation or likely dispute.
Preserve the notice: keep the subpoena, warrant, demand letter, target letter, or other document exactly as received.
Record the contact: note who made contact, the agency or company involved, what was requested, and any deadline stated.
Avoid guessing: do not give an improvised explanation about permissions, files, passwords, or intent before reviewing the records.
Do not contact witnesses: messages intended to “get the story straight” can create additional concerns.
Keep devices intact: do not reset, wipe, discard, or run cleaning software on relevant computers or phones.
Obtain independent counsel: company counsel represents the company unless that lawyer clearly agrees to represent you personally.
Counsel can identify the document’s scope, communicate with investigators or opposing lawyers, issue appropriate preservation instructions, and begin reconstructing the access timeline. Our guide to federal investigations explains how target letters, subpoenas, interviews, search warrants, and pre-charge government inquiries differ—and why each may require a different response.
How Keith & Lorfing prepares a CFAA defense
A federal computer case needs more than a broad claim that the defendant was “allowed to use the system.” The defense must connect authorization, access controls, digital events, and the required mental state to specific dates and charged conduct.
We approach that work by identifying the exact subsection, preserving relevant evidence, building a permissions timeline, comparing policy language with system configuration, reviewing forensic methods, and challenging damage or loss calculations that do not match the statute. When a business dispute is involved, our experience with internal corporate investigations helps us assess the criminal and organizational issues together.
Speak with a West Texas federal defense attorney
A server log may show an event, but it rarely tells the whole story about permission, identity, knowledge, or intent. Before responding to a subpoena, interview request, target letter, or accusation from a former employer, let us help you determine what the records actually prove.
Contact Keith & Lorfing or call (325) 480-8100 for a free consultation. We serve clients from offices in Abilene, Lubbock, Midland, and San Angelo.
Frequently asked questions
Is violating a workplace computer policy a CFAA crime?
Not by itself. Van Buren held that using permitted access for an improper purpose does not amount to exceeding authorized access under § 1030(a)(2).
The analysis changes if the person entered an account, database, folder, or file that was off-limits. Other criminal laws, civil claims, or workplace consequences may also apply even when the CFAA does not.
Is using another person’s password always unauthorized?
No single rule resolves every password-sharing case. Permission from the account holder may matter, but the key question is whether that person or another source had authority to grant access to the underlying computer and information.
An employer-owned account, a platform’s separate access controls, a revoked permission, or entry into another restricted area can change the result. The source and scope of authorization must be established from the actual records.
Does access become illegal as soon as employment ends?
Not automatically in every case, but continued access after a clear revocation can support a “without authorization” theory. The timing of termination, notice, account deactivation, contractual duties, and later access all matter.
An account remaining active does not necessarily mean permission continued. It is evidence that must be considered with the full authorization history.
Can web scraping violate the CFAA?
It depends on what was accessed and how. Scraping information available to the public presents a different question from bypassing authentication, entering another user’s account, or circumventing a code-based restriction.
Current DOJ policy says a prosecution should not rest solely on violating terms of service for a public web service. That policy does not resolve possible liability under other laws or every form of technical circumvention.
Is good-faith security research protected?
DOJ policy directs prosecutors to decline CFAA charges when the available evidence shows qualifying good-faith security research. The policy defines it narrowly around testing, investigation, or correction of a security flaw conducted to avoid harm and promote security or safety.
Calling activity “research” is not enough. Authorization, methods, harm, disclosure, purpose, and any demand for payment can affect whether the policy applies.
What counts toward the CFAA’s $5,000 loss figure?
The statute can include reasonable incident-response, damage-assessment, and restoration costs. Lost revenue and other consequential damages fall within “loss” when caused by an interruption of service.
The calculation can be challenged when costs were unrelated, unreasonable, ordinary business expenses, general upgrades, or not caused by the alleged conduct. The $5,000 factor aggregates qualifying loss during a one-year period.
Can a company sue even if no criminal charges are filed?
Yes. Section 1030(g) creates a civil remedy when a violation caused damage or loss and the conduct involves at least one listed harm factor.
A civil CFAA case and a federal investigation are separate. Because evidence and statements can cross between them, responding to one without considering the other can create avoidable risk.
