Federal Sentencing in CFAA Cases: The $5,000 Loss Threshold

The $5,000 Threshold

Section summarySection 1030(c)(4)(A)(i)(I) ties felony classification to $5,000 in aggregated one-year loss. Below the line, §1030(a)(5) cases are typically misdemeanors; at or above the line, they are felonies with up to 10 years of statutory exposure.

The threshold language matters. §1030(c)(4)(A)(i)(I) reaches loss to "one or more persons during any one-year period" aggregating at least $5,000. Three pieces are doing work:

• Aggregation across victims. Loss to multiple persons can be combined.
• One-year window. The aggregation window is set, which can include or exclude downstream effects depending on timing.
• Caused or could have caused. The statute reaches actual and reasonably foreseeable loss.

For a defendant facing potential §1030(a)(5) charges, the threshold is the first defense line. If the loss methodology cannot support $5,000 aggregated within the one-year window, felony charging fails and a misdemeanor case remains. Our §1030(a)(2) explainer covers the parallel unauthorized-access subsection, which has different charging mechanics.

How CFAA Defines "Loss"

Section summaryLoss under §1030(e)(11) is statutorily defined and includes response cost, damage assessment, data restoration, lost revenue from interruption, and other consequential costs of the offense — broader than out-of-pocket monetary damage.

§1030(e)(11) defines loss as:

• Any reasonable cost to any victim.
• Including the cost of responding to the offense.
• Conducting a damage assessment.
• Restoring the data, program, system, or information to its condition prior to the offense.
• Any revenue lost, cost incurred, or other consequential damages due to interruption of service.

The breadth of this definition is what makes the $5,000 threshold easier to clear than it might first appear. A relatively modest intrusion that triggers an outside-counsel forensic engagement, internal IT response, and a few hours of service interruption can quickly aggregate over $5,000 in claimed loss. The phrase "reasonable cost" is the defense fulcrum — not every dollar booked to the response is necessarily reasonable, and the government must support its loss methodology.

USSG §2B1.1 Loss Table

Section summaryOnce a felony §1030(a)(5) charge attaches, sentencing turns to USSG §2B1.1's loss table. The table adds offense-level enhancements that scale from +2 at loss over $6,500 to +30 at loss over $550 million.

USSG §2B1.1 is the fraud and theft guideline, and CFAA cases route into it via Appendix A. The loss table at §2B1.1(b)(1) is the central driver:

• Loss more than $6,500: +2 levels
• Loss more than $15,000: +4 levels
• Loss more than $40,000: +6 levels
• Loss more than $95,000: +8 levels
• Loss more than $150,000: +10 levels
• (and continuing upward through +30 at $550M)

The exact numbers should be checked against the current Guidelines Manual at the time of sentencing, since the loss-table thresholds have been amended. The interaction with the $5,000 charging threshold is important: §2B1.1's "loss" can be calculated differently than §1030(e)(11)'s "loss," and the disconnect is a frequent defense issue. The federal sentencing guidelines calculator models the offense-level math for the full §2B1.1 application; the federal fraud-loss calculator walks through the loss-calculation step specifically.

Charging Discretion at the Margin

Section summaryEven when the $5,000 threshold is met, federal prosecutors retain charging discretion. Marginal-threshold cases — those just over $5,000 — are sometimes resolved as misdemeanors or declined where federal interest is limited.

Federal prosecutors in the Northern District of Texas (Dallas, Fort Worth) and Eastern District of Texas (Sherman, Plano, Tyler) apply charging policies and DOJ guidance that allow declination or misdemeanor resolution in marginal cases. Factors that influence the call include:

• Whether the loss is robustly documented or thin.
• Whether the conduct was a one-off or part of a pattern.
• Whether the victim was a federal interest, financial institution, or critical infrastructure.
• Whether a state remedy under Texas Penal Code §33.02 is adequate.
• The defendant's cooperation posture and personal history.

Early defense engagement before charging — when declination is still possible — is often the highest-leverage point in the whole case. Once an indictment lands, the leverage shifts toward sentencing mitigation rather than charging. If you are mapping a fact pattern against the available subsections, our CFAA charge-subsection spotter walks through the analysis.

Defense Strategy on Loss

Section summaryDefense work on loss has two tracks: (1) challenge the methodology to keep the case under the $5,000 felony threshold; (2) once felony, challenge the §2B1.1 loss figure to reduce the guideline range.

The two-track approach:

• Pre-charging or early-case track. Pressure-test the loss calculation against §1030(e)(11). What costs were actually incurred? Were they reasonable? Were they caused by the offense or by unrelated security investment? If the answer brings the figure below $5,000, the felony case fails.
• Post-conviction sentencing track. If a felony conviction is unavoidable, the §2B1.1 loss figure determines the offense level. Defense counsel can challenge each line item — forensic costs, lost revenue projections, restoration estimates — under preponderance-of-the-evidence sentencing standards.

The two tracks use the same underlying records: incident reports, vendor invoices, internal time entries, revenue impact analyses. Getting them under subpoena or through discovery is the first step. Our Texas Computer Crimes Defense Guide covers the full charging-and-sentencing architecture; our §1030(a)(4) analysis covers the parallel fraud subsection where loss interacts differently.

Frequently Asked Questions

Next Steps

If you are facing a situation described here, consult counsel promptly. Many issues in this area run on strict deadlines.

• Call (972) 370-5060
• Email info@landllawgroup.com