What is the CFAA — multi-subsection framework at § 1030?
The Computer Fraud and Abuse Act at 18 U.S.C. § 1030 is a multi-subsection federal statute criminalizing seven categories of computer-related conduct. Penalties scale from misdemeanors to felonies up to 10 years per count, with national-defense subsections reaching life imprisonment via espionage-act crosswalks.
- § 1030(a)(1) — National defense or restricted data
- Knowingly accessing a computer without authorization or exceeding authorized access, and obtaining national-defense information, foreign-relations data, or restricted nuclear data, with reason to believe such information could be used to the injury of the United States or to the advantage of a foreign nation. First-offense exposure runs up to 10 years; second offense up to 20 years. Espionage-act crosswalk provisions (18 U.S.C. §§ 793, 794, 798) allow life-imprisonment exposure where the conduct also constitutes traditional espionage. This subsection produces the highest-exposure CFAA prosecutions and is litigated primarily by the National Security Division at DOJ.
- § 1030(a)(2) — Unauthorized access obtaining information
- Intentionally accessing a computer without authorization or exceeding authorized access, and thereby obtaining (A) information from any financial institution's records, (B) information from any department or agency of the United States, or (C) information from any protected computer (the modern catch-all clause). First offense without aggravating factors is a misdemeanor (up to 1 year); becomes a felony (up to 5 years, or 10 for repeat conduct) where committed for commercial advantage or private financial gain, in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or any State, or where the value of the information obtained exceeded $5,000. After Van Buren v. United States, 593 U.S. 374 (2021), "exceeds authorized access" is read narrowly — gate-up breaches only.
- § 1030(a)(4) — Access with intent to defraud
- Knowingly and with intent to defraud accessing a protected computer without authorization, or exceeding authorized access, and by means of such conduct furthering the intended fraud and obtaining anything of value (other than the use of the computer and the value of such use does not exceed $5,000 in any 1-year period). Up to 5 years for a first offense; up to 10 years for repeat conduct. The "intent to defraud" element imports common-law fraud principles — a scheme to deprive another of money, property, or honest services by deception. Frequently charged alongside wire fraud under § 1343 to capture both the computer-access element and the broader fraudulent scheme.
- § 1030(a)(5) — Damage to protected computers
- Three sub-clauses: (A) knowingly causes transmission of a program, information, code, or command, and as a result intentionally causes damage without authorization to a protected computer; (B) intentionally accesses a protected computer without authorization, and as a result of such conduct recklessly causes damage; (C) intentionally accesses a protected computer without authorization, and as a result of such conduct causes damage and loss. Penalties scale with the aggravating circumstances and damage amount — first offense up to 10 years; up to 20 years for repeat conduct or aggravated damage; life imprisonment available where the offense results in death. The $5,000 aggregate loss threshold applies for felony charging.
- § 1030(a)(7) — Extortion via computer threats
- Transmitting in interstate or foreign commerce any communication containing (A) any threat to cause damage to a protected computer, (B) any threat to obtain information from a protected computer or impair the confidentiality of information obtained from a protected computer, or (C) any demand or request for money or other thing of value in relation to damage to a protected computer where such damage was caused to facilitate the extortion. Up to 5 years for a first offense; up to 10 years for repeat conduct. This subsection captures ransomware demands, hack-and-leak threats, and other extortion-by-computer schemes. Frequently charged alongside Hobbs Act extortion under 18 U.S.C. § 1951.
The Computer Fraud and Abuse Act was enacted in 1986 against a backdrop of growing concern about computer intrusions and was substantially amended in 1996, 2001, 2002, and 2008 to broaden its reach. The result is a multi-subsection statute that covers a wide range of conduct — from unsophisticated unauthorized access by a curious employee to ransomware demands by sophisticated international threat actors to nation-state espionage. The structural challenge in any CFAA defense is identifying which subsection the government has charged, what the precise elements of that subsection require, and how the post-2021 narrowing in Van Buren v. United States reshapes the analysis.
A critical structural feature: the CFAA's "protected computer" jurisdictional element under § 1030(e)(2) is functionally universal in the internet age — any computer used in or affecting interstate or foreign commerce or communication qualifies, which captures essentially every computer connected to the internet. The protected-computer element therefore generates few serious disputes in modern CFAA practice. The live disputes center almost entirely on (1) whether the defendant's access was authorized or exceeded authorization, (2) the requisite mental state for the specific subsection charged, (3) damage and loss calculation where § 1030(a)(5) is charged, and (4) loss-amount thresholds for felony charging under § 1030(a)(2)(B) and § 1030(c)(4).
CFAA prosecutions in the Northern District of Texas and the Eastern District of Texas have grown substantially over the past five years as cybercrime — ransomware, business-email-compromise schemes, healthcare-records intrusions, intellectual-property theft from defense contractors — has emerged as a federal enforcement priority. The FBI's Dallas Field Office Cyber Squad coordinates investigation; the U.S. Attorney's Office Cyber and Intellectual Property Crime Section in NDTX prosecutes. The Eastern District handles a substantial caseload of cases originating from Plano, Frisco, Sherman, McKinney, and the broader I-635/I-75 corridor, often involving insider-access, business-email-compromise, and ransomware-affiliate prosecutions.
Section 1030(a)(2) after Van Buren — the gates-up rule
The Supreme Court's 2021 decision in Van Buren v. United States narrowed § 1030(a)(2) sharply — "exceeds authorized access" applies only to true gate-up breaches, not to misuse of information one was authorized to obtain. Policy violations and "improper purpose" theories no longer support CFAA liability.
Van Buren v. United States, 593 U.S. 374 (2021), was the most consequential CFAA decision of the past decade. The defendant, a Georgia police sergeant, used his lawful access to a state law-enforcement license-plate database to look up plates for personal reasons unrelated to law-enforcement business. He was paid by an FBI informant to perform the lookups in a sting operation. The government charged him under § 1030(a)(2)(B) — accessing a protected computer in a manner that "exceeds authorized access." The lower courts (11th Circuit) applied the broad "purpose-based" reading: although Van Buren was authorized to access the database, his improper purpose for the lookup converted authorized access into "exceeding authorized access" because the agency policy permitted access only for law-enforcement purposes.
The Supreme Court reversed 6-3 in an opinion by Justice Barrett. The Court held that "exceeds authorized access" under § 1030(e)(6) means "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter" — and that "not entitled so to obtain or alter" refers to areas of the computer (files, folders, databases) the user has no right to access at all, not areas the user can access but for purposes the system owner doesn't approve. The Court adopted what it called a "gates-up-or-down" framework: the question is whether the user breached a gate at all, not why he wanted to walk through it. Van Buren had authorized access to the entire database for any reason — even an improper one — so his lookup did not "exceed" authorization within the statute's meaning.
The implications of Van Buren reach far beyond police-database misuse. The decision invalidated entire categories of pre-2021 CFAA theories: employee-policy-violation prosecutions where employees with database access used it for unauthorized side ventures; public-data-scraping cases against researchers and journalists who used automated tools to access publicly-available website data in ways the site's terms of service prohibited; competitive-intelligence cases where employees of one firm collected information from another firm's public-facing systems. Each of these had been actively prosecuted under the broad pre-Van Buren reading. After Van Buren, none of them survives unless the government can identify a true gate-up breach — access to a folder, database, or system the user had no right to access at all.
The 9th Circuit's decision in hiQ Labs v. LinkedIn, 31 F.4th 1180 (2022), applied Van Buren directly to public-data scraping. The court held that hiQ's scraping of public LinkedIn profile data did not constitute "access without authorization" under § 1030(a)(2) — the data was publicly available, and accessing public data could not be "without authorization" within the statute's meaning. hiQ effectively closed off CFAA liability for scraping of publicly-accessible web pages, even where the site owner expressly prohibited automated access. The pre-Van Buren United States v. Nosal, 844 F.3d 1024 (9th Cir. 2016) (en banc dissent foreshadowing the narrow reading), is now the dominant analytical framework — the 9th Circuit had been ahead of the Supreme Court on this question, and Nosal's underlying reasoning controls the post-Van Buren landscape.
For defense practice in DFW federal courts, Van Buren's practical implications are substantial. Pre-2021 indictments under broad "purpose-based" theories were not unusual in NDTX/EDTX. Post-Van Buren, the defense develops the gates-up analysis at the motion-to-dismiss stage: does the indictment allege a true breach of access boundaries, or does it allege misuse of authorized access? Where the indictment fails to allege a gate-up breach, dismissal is the appropriate remedy. Where the government supplements with additional facts at trial, the defense moves for judgment of acquittal under Rule 29 on the access element. The legal question is now well-settled by Van Buren — the difficulty is in litigating the specific factual record in a way that forces the court to apply the narrowed standard.
Section 1030(a)(4) — intent to defraud
Section 1030(a)(4) criminalizes knowingly accessing a protected computer with intent to defraud and obtaining anything of value over $5,000. The intent-to-defraud element imports common-law fraud principles and is frequently charged alongside wire fraud under § 1343.
Section 1030(a)(4) sits at the intersection of computer-access offenses and traditional fraud. The statute criminalizes "knowingly and with intent to defraud, access[ing] a protected computer without authorization, or exceed[ing] authorized access, and by means of such conduct further[ing] the intended fraud and obtain[ing] anything of value." The exposure is up to 5 years for a first offense and up to 10 years for repeat conduct. The $5,000 carve-out — "unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period" — operates as a de minimis exclusion for trivial computer-use cases.
The "intent to defraud" element imports the common-law fraud framework that runs through 18 U.S.C. § 1341 (mail fraud) and § 1343 (wire fraud). The government must prove a scheme or artifice to deprive another of money, property, or honest services by deception. The deception must be material — capable of influencing a reasonable person — and the defendant must have acted with specific intent to defraud, not merely negligently or even recklessly. Neder v. United States, 527 U.S. 1 (1999), is the foundational decision on the materiality requirement in federal fraud statutes; the Neder framework applies with full force in § 1030(a)(4) prosecutions.
In practice, § 1030(a)(4) is frequently charged alongside wire fraud under § 1343 to capture both the computer-access element and the broader fraudulent scheme. The two charges have substantial overlap — § 1030(a)(4) requires unauthorized access plus intent to defraud, while wire fraud requires a fraudulent scheme plus interstate-wire use in furtherance. A defendant who breaches a corporate computer system to redirect wire transfers will typically face both § 1030(a)(4) for the unauthorized access and § 1343 for the wires used to redirect the funds. Sentencing under the Guidelines treats the conduct as a single offense for grouping purposes under U.S.S.G. § 3D1.2, but the parallel charges expand the government's plea-bargaining leverage and create separate appellate vehicles.
Defense challenges to § 1030(a)(4) prosecutions typically focus on the mens-rea element. Did the defendant act with specific intent to defraud, or merely without consideration of fraud as a possible consequence? Where the defendant's access was authorized in a broad sense (he had legitimate credentials to the system) but the government argues the specific use was unauthorized, the Van Buren gates-up analysis matters here too — the underlying "without authorization or exceeding authorized access" predicate must satisfy the narrowed standard. A defense that pulls the case from § 1030(a)(4) into a non-CFAA theory (e.g., breach-of-contract or unfair-competition) can sometimes eliminate the federal computer-crime exposure even where the underlying conduct is genuinely problematic.
Section 1030(a)(5) — damage to protected computers
Section 1030(a)(5) covers three distinct theories of computer damage — knowing transmission of damaging code, reckless damage from unauthorized access, and damage from unauthorized access generally. Penalties scale with the damage amount and aggravating circumstances, reaching life imprisonment where the offense results in death.
Section 1030(a)(5) divides damage-related conduct into three sub-clauses with different mens-rea structures. Sub-clause (A) is the most aggravated — "knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer." This is the classic malware-transmission and ransomware-deployment theory. The mens rea requires both knowing transmission and intentional damage — the government must prove the defendant knew what he was transmitting and intended the resulting damage, not merely that damage was a foreseeable consequence. Up to 10 years for a first offense; up to 20 years for repeat conduct or aggravated damage; life imprisonment where the conduct results in death.
Sub-clause (B) lowers the mens rea: "intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage." The damage need not be intended — the defendant must have acted intentionally in accessing without authorization, and the damage must have been a reckless consequence. This sub-clause captures the unsophisticated intruder who probes a system or extracts data and damages the system unintentionally in the process. First-offense felony exposure runs up to 5 years; the felony threshold requires either $5,000+ in aggregate loss, impact on medical care, physical injury, threat to public safety, or damage to a justice/national-defense/national-security computer.
Sub-clause (C) is the broadest and the most contested in modern practice: "intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss." No mens rea is required as to the damage — only as to the access. The "and loss" requirement adds an additional element: actual loss to one or more persons during any 1-year period aggregating at least $5,000. The defense work here often centers on the loss calculation — what counts as "loss" under § 1030(e)(11)? The statute defines loss broadly to include any reasonable cost of responding to an offense, conducting damage assessment, restoring data, programs, system or information, and any revenue lost or other consequential damages incurred. Challenges to the $5,000 loss threshold are frequent and sometimes successful — particularly where the company's response costs are inflated by precautionary or overresponse activity rather than actual damage repair.
Aggravation provisions multiply the exposure. Section 1030(c)(4) lists circumstances that elevate damage-subsection offenses to higher penalty tiers — loss to one or more persons during any 1-year period aggregating at least $5,000; modification or impairment of medical care; physical injury to any person; threat to public health or safety; damage to a justice/national-defense/national-security computer; damage affecting 10 or more protected computers during any 1-year period. The government almost always pleads at least one aggravator to maintain felony exposure; defense work includes challenging each pleaded aggravator on the factual record.
Defense strategies in CFAA cases
CFAA defense work centers on five recurring battlegrounds — Van Buren gates-up analysis, mens-rea challenges (knowingly/intentionally/intent to defraud), $5,000 loss-amount challenges, venue challenges, and First Amendment overlap in online-speech cases.
The Van Buren gates-up analysis is the foundational defense move in any § 1030(a)(2) or § 1030(a)(4) prosecution. The defense identifies whether the indictment alleges a true gate-up breach of access boundaries or merely misuse of authorized access. Pre-2021 indictments often relied on broad employee-policy-violation theories that Van Buren has invalidated. Motion-to-dismiss practice under Rule 12 is appropriate where the indictment's allegations cannot satisfy the narrowed standard. Where the indictment survives motion practice but the trial record shows authorized access misused, Rule 29 motion for judgment of acquittal becomes the vehicle. The 9th Circuit's post-Van Buren applications in hiQ Labs v. LinkedIn, 31 F.4th 1180 (2022), and subsequent cases provide persuasive authority for narrow construction even outside the 9th Circuit.
Mens-rea challenges run through every CFAA subsection. Section 1030(a)(2) requires intentional access; § 1030(a)(4) requires knowing access with intent to defraud; § 1030(a)(5)(A) requires both knowing transmission and intentional damage. The government must prove each mental state beyond a reasonable doubt. Defense work develops the defendant's actual subjective awareness — what did he understand about his access rights, what did he intend to do, what did he understand about the system he was accessing? Cognitive-state expert testimony is sometimes appropriate; documentary evidence of policies, training, and access-grant records is routinely contested. A defense that creates reasonable doubt about the specific mens rea required for the charged subsection — even where the conduct is otherwise problematic — can produce acquittal.
$5,000 loss-amount challenges are the dominant defense tactic in § 1030(a)(5)(C) prosecutions. The statute requires "loss to one or more persons during any 1-year period aggregating at least $5,000 in value" for felony charging. The defense challenges the company's loss calculation by examining (1) what costs the company actually incurred, (2) whether those costs were "reasonable" within § 1030(e)(11)'s definition, (3) whether the costs were causally tied to the defendant's conduct or to broader security investments the company would have made anyway, and (4) whether the company's response was proportionate or whether it overresponded for strategic or PR reasons. Forensic-accounting expert work is often dispositive. A successful sub-$5,000 finding reduces the offense from a felony to a misdemeanor under § 1030(c)(2)(A).
Venue challenges are recurring in remote-access cases. United States v. Auernheimer, 748 F.3d 525 (3d Cir. 2014), reversed a CFAA conviction on venue grounds — the defendant accessed AT&T servers in Texas and Georgia from his home in Arkansas; the indictment was returned in New Jersey, where neither the defendant's conduct nor the affected servers were located. The Third Circuit held that venue in New Jersey was improper because no essential conduct occurred there. Defense work in remote-access cases identifies where the defendant's access conduct occurred and where the affected systems are located; if the government has charged in a district where neither occurred, a Rule 18 venue challenge can produce dismissal or transfer.
First Amendment defenses arise in the subset of CFAA cases involving online speech. The Supreme Court's decision in Counterman v. Colorado, 600 U.S. 66 (2023), held that the First Amendment requires a subjective mens-rea showing — at least recklessness — before the government can criminalize speech as a "true threat." For § 1030(a)(7) extortion-by-computer prosecutions involving threats to damage computers or release information, the Counterman framework can constrain what the government must prove about the defendant's subjective awareness. The defense develops the speech-act analysis: was the defendant's communication a true threat as understood by the speaker, or was it protected speech (hyperbole, satire, public criticism) that the government has overreached in prosecuting?
Cooperation under 5K1.1 is the standard mitigation track in CFAA cases. The federal sentencing guidelines for fraud offenses under § 2B1.1 produce substantial loss-based enhancements that can lift CFAA Guidelines exposure into the multi-year range even on first offenses. A 5K1.1 substantial-assistance motion from the government — available only where the defendant provides cooperation against more culpable co-defendants or against organized cybercrime networks — produces a below-Guidelines departure that can reduce the actual sentence by 30-50%. Cooperation in computer-fraud cases often involves technical assistance to investigators on the architecture of an intrusion, identification of co-conspirators, attribution of attacks to known threat actors, or recovery of stolen data. The cooperation calculus must be weighed carefully against the risks — particularly where co-defendants are foreign nationals or affiliated with organized criminal networks.
Texas state alternatives — § 33.02 Breach of Computer Security, SCA, Wiretap
Texas Penal Code § 33.02 — Breach of Computer Security — is the state-law analog to the CFAA. Federal prosecutions often run alongside Stored Communications Act (§ 2701) and Wiretap Act (§ 2511) counts that multiply exposure.
Texas Penal Code § 33.02 — Breach of Computer Security — is the state-law analog to the federal CFAA. The statute criminalizes "knowingly access[ing] a computer, computer network, or computer system without the effective consent of the owner." Penalties scale with the aggregate amount involved: under $2,500 is a Class B misdemeanor (up to 180 days, up to $2,000 fine); $2,500 to under $30,000 is a state-jail felony (180 days to 2 years, up to $10,000); $30,000 to under $150,000 is a 3rd-degree felony (2-10 years, up to $10,000); $150,000 to under $300,000 is a 2nd-degree felony (2-20 years, up to $10,000); $300,000 or more is a 1st-degree felony (5-99 years or life, up to $10,000). The "knowingly" mens rea aligns with federal § 1030 standards, though Texas courts have not adopted the Van Buren gates-up narrowing as a matter of state law.
Related Texas computer offenses include § 33.022 (Electronic Access Interference) — disrupting or denying use of a computer system or network — and § 33.023 (Electronic Data Tampering) — altering, damaging, or deleting data without effective consent. Section 33.07 (Online Impersonation) criminalizes creating fake online accounts or sending electronic communications using another's identifying information to harm or defraud. Each statute carries its own penalty scale and may be charged alongside § 33.02 to capture different aspects of the same intrusion. State prosecutions are typically brought by the Texas Attorney General's Cyber Crime Unit or by local district attorneys with cyber capability — in DFW, the Collin County, Dallas County, Denton County, and Tarrant County DAs all maintain such capability.
The Stored Communications Act, 18 U.S.C. § 2701, is the most frequently-charged federal companion statute in CFAA prosecutions. The SCA criminalizes "intentionally access[ing] without authorization a facility through which an electronic communication service is provided," or "intentionally exceed[ing] an authorization to access that facility," and thereby obtaining, altering, or preventing authorized access to a wire or electronic communication while it is in electronic storage. The SCA covers email-system breaches, cloud-storage intrusions, and social-media-account compromises in ways § 1030 may not — different elements, different scope. Many indictments include parallel § 1030 and § 2701 counts capturing different aspects of the same conduct, with cumulative exposure of 10 years on the CFAA count plus 5 years on the SCA count for first offenses.
The Wiretap Act at 18 U.S.C. § 2511 criminalizes the intentional interception of wire, oral, or electronic communications in real time. The distinction from the SCA is the temporal element: the Wiretap Act applies to communications in transit ("interception"), while the SCA applies to communications already received and in electronic storage. Real-time keystroke logging, network packet capture during transmission, and live VOIP recording fall under the Wiretap Act; access to already-delivered emails sitting on a server falls under the SCA. The Wiretap Act carries up to 5 years per count and is frequently charged in cases involving sophisticated network-monitoring or surveillance-software deployment. United States v. Ropp, 347 F. Supp. 2d 831 (C.D. Cal. 2004), and subsequent cases address the contested intercept/storage line that often determines which statute applies.
Local DFW federal practice — NDTX, EDTX, FBI Cyber Squad
CFAA prosecutions in the Northern District of Texas (Dallas, Fort Worth, Plano divisions) and Eastern District of Texas (Sherman, Plano divisions) have grown substantially. The FBI Dallas Field Office Cyber Squad coordinates investigation; AUSAs in both districts maintain dedicated computer-crime capacity.
CFAA prosecutions in the Northern District of Texas and the Eastern District of Texas have grown substantially over the past five years as the DOJ's strategic emphasis on cybercrime — ransomware, business-email compromise, healthcare-records intrusions, intellectual-property theft from defense contractors, cryptocurrency-related computer fraud — has intensified. The FBI Dallas Field Office Cyber Squad coordinates investigation across both districts and works closely with the DOJ's National Cyber-Forensics and Training Alliance (NCFTA), the U.S. Secret Service's Electronic Crimes Task Force, and the DOJ's Computer Crime and Intellectual Property Section (CCIPS) in Washington.
The NDTX U.S. Attorney's Office in Dallas maintains a Cyber and Intellectual Property Crime Section staffed by AUSAs with technical fluency in computer-intrusion prosecutions. Recent NDTX cases have included ransomware-affiliate prosecutions, business-email-compromise schemes targeting Dallas-area corporations, intellectual-property theft from defense and technology firms, and identity-theft conspiracies leveraging compromised credentials. The Fort Worth Division handles cases originating from Tarrant County and the western half of the district. Plea practice in NDTX cyber cases is fast-moving — the government often presents plea offers within 60-90 days of indictment, and defense counsel must move quickly to develop the gates-up analysis, mens-rea theory, and loss-amount challenges that shape the negotiation.
The EDTX U.S. Attorney's Office in Plano has a substantial computer-crime docket originating from the Plano, Frisco, Sherman, McKinney, and broader I-635/I-75 corridor. The Plano Division handles cases from Collin County (including Frisco where L and L Law Group is located) and from the surrounding counties. EDTX has been particularly active in business-email-compromise and insider-access prosecutions involving employees at North Dallas-area corporations. The Sherman Division covers Grayson, Fannin, Lamar, and other counties further north. AUSAs in both EDTX divisions coordinate with the FBI Dallas Cyber Squad and with the Plano Police Department's Cyber Crime Unit on parallel state/federal investigations.
For defendants residing in Frisco, Plano, McKinney, and the broader Collin County area, a federal computer-fraud indictment typically lands in either EDTX (Plano Division) or NDTX (Dallas Division) depending on where the conduct occurred and where the affected systems were located. Forum-selection considerations matter — the two districts have somewhat different plea-practice cultures, sentencing tendencies, and judicial pools. Defense counsel familiar with both districts can sometimes shape forum at the pre-indictment cooperation stage, though once an indictment is returned, venue can only be challenged on the narrow Rule 18 grounds illustrated by Auernheimer. Pretrial detention practice differs as well — NDTX magistrates tend to grant pretrial release with conditions in white-collar computer-fraud cases more readily than in violent-crime cases, but the Bail Reform Act's flight-risk and danger analyses are case-specific.
When to retain federal counsel
Pre-indictment retention in CFAA matters is critical. Federal grand-jury subpoenas, target letters, FBI interviews, and search-warrant executions all signal active investigation. Early counsel can shape charging decisions, preserve Fifth Amendment rights, and develop the Van Buren gates-up theory before indictment.
The single most consequential decision in any federal computer-fraud matter is when to retain counsel. Federal investigations frequently develop over 12-24 months before any indictment is returned — and the defendant's exposure during that pre-indictment window is shaped substantially by what counsel can accomplish before the grand jury votes. The standard signals that an active CFAA investigation is underway include a federal grand-jury subpoena directing the defendant to produce documents or testify; a "target letter" from the U.S. Attorney's Office identifying the defendant as a target of an ongoing investigation; an FBI agent or other federal investigator requesting an interview; execution of a federal search warrant at the defendant's residence or office; or a federal arrest warrant. Each of these signals demands immediate response.
Pre-indictment counsel work on a CFAA matter involves three core activities. First, investigation triage — what did the defendant actually do, what evidence does the government likely have, and what are the realistic exposures under each potentially-applicable subsection? Second, Fifth Amendment protection — preserving the defendant's right against self-incrimination by managing any communications with investigators and by ensuring no statements are made that the defendant cannot afford to have made. Third, pre-charge dialogue with the AUSA — where appropriate and where the case posture supports it, presenting counsel-developed material that may shape the charging decision (e.g., evidence that the defendant's access was authorized, that the loss calculation overstates actual damage, or that Van Buren precludes the broad theory the government may be considering).
Many CFAA matters never result in indictment when counsel intervenes early and effectively. Pre-charge declinations are not unusual where the defense can persuade the AUSA that the case has weaknesses on the mens-rea element, on the access-authorization element, or on the loss-amount threshold. Once an indictment is returned, however, the case posture changes fundamentally — the AUSA has publicly committed to the prosecution, the grand jury has voted, and the deferential standard for grand-jury proceedings makes pre-indictment "do-over" motions difficult. The pre-indictment window is therefore strategically critical, and defendants who retain counsel only after indictment have already lost the most valuable defense lever.
Selecting counsel for a federal computer-fraud matter requires specific qualifications. Federal court admission and substantial federal trial experience — not just state criminal-defense experience — is the baseline. Familiarity with the CFAA's multi-subsection structure, with the Van Buren framework, with Federal Sentencing Guideline § 2B1.1 fraud calculations, and with the technical aspects of computer-intrusion evidence (forensic imaging, network log analysis, malware analysis, cryptocurrency tracing) is essential. The L and L Law Group team — co-founding partners Reggie London and Njeri London — both maintain federal court admissions in NDTX, EDTX, and the Fifth Circuit Court of Appeals, with substantial experience defending federal computer-fraud, wire-fraud, and other white-collar prosecutions across both districts.
