CFAA Charge Subsection Spotter

The 7 Subsections of 18 USC 1030 — What Each Targets

The Computer Fraud and Abuse Act, codified at 18 U.S.C. §1030, criminalizes seven distinct categories of computer-related conduct. Each subsection has its own elements, mens rea requirement, and grading scheme. Understanding which subsection the government is charging — and which it could have charged instead — is the first move in any CFAA defense.

Prosecutors typically charge the subsection that best fits the conduct and that yields the strongest sentencing exposure. The (a)(2), (a)(4), and (a)(5) trio account for the vast majority of CFAA prosecutions. The (a)(1) and (a)(3) subsections are reserved for national-security and government-computer cases. The (a)(6) trafficking subsection is often paired with (a)(2) or (a)(4) when the conduct involves selling or distributing access credentials.

The "Protected Computer" Definition — §1030(e)(2)

Most CFAA subsections require access to a "protected computer." That term is defined broadly in 18 U.S.C. §1030(e)(2) to include any computer used in or affecting interstate or foreign commerce or communication, any computer used by a financial institution or the United States government, and any computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States.

In practical effect, any computer connected to the internet is a "protected computer" for CFAA purposes. Courts have held that the jurisdictional hook is satisfied by ordinary email, web browsing, or interstate data transmission. This breadth has been criticized but remains the controlling reading. The result is that the CFAA reaches almost any computer-related conduct that touches interstate commerce — which is to say, nearly all of it.

"Without Authorization" vs "Exceeding Authorized Access" — Van Buren v. United States

The single most important development in CFAA law in the last decade is Van Buren v. United States, 593 U.S. 374 (2021). The Supreme Court resolved a circuit split on the meaning of "exceeds authorized access" — a phrase that appears in §1030(a)(2) and §1030(a)(4). The Court held, in a 6-3 decision authored by Justice Barrett, that the phrase covers only conduct where the user accesses files, folders, databases, or other areas of a computer that they are not entitled to access at all. It does not cover misuse of information from areas the user was permitted to enter.

The Court adopted what it called a "gates-up or gates-down" inquiry. The question is: was the gate to that part of the system open to the user, or closed? If the gate was open and the user walked through it, the access is authorized — even if the user then used the information for a forbidden purpose. If the gate was closed and the user picked the lock or climbed over the fence, the access exceeds authorization.

The Van Buren ruling does not eliminate CFAA prosecutions. The government can still charge conduct involving stolen credentials, bypassed access controls, gates that were clearly closed, and access by terminated employees whose authorization was revoked. But the broad "violation of usage policy equals exceeding access" theory is dead. Counsel should evaluate every CFAA charge through the gates-up or gates-down lens.

The $5,000 Loss Threshold — §1030(e)(11)

Several CFAA subsections grade as misdemeanors unless an enhancement applies. The most common enhancement is the $5,000-in-loss threshold. Section 1030(c)(4)(A)(i)(I) makes a §1030(a)(5) damage offense a felony if the offense caused (or would have caused) "loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value."

The statutory definition of "loss" is in 18 U.S.C. §1030(e)(11): "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service."

What counts:

• Forensic incident-response costs (internal IT time, outside consultants)
• Damage-assessment time and labor
• Restoration and remediation costs (rebuilding systems, restoring data)
• Lost revenue during the period of service interruption
• Consequential damages from the service interruption

What does not count: speculative future losses, the value of the data itself (apart from restoration cost), and losses that would have occurred regardless of the conduct. The $5,000 figure aggregates across victims over a one-year period — a useful prosecution tool but also a target for defense challenges where the government's loss calculation includes items outside the statutory definition.

Sentencing Under USSG §2B1.1 + Special Enhancements

CFAA offenses are sentenced under the United States Sentencing Guidelines. Most CFAA charges run through USSG §2B1.1, the general theft and fraud guideline. The base offense level is 6 or 7 depending on the statutory maximum, and the loss-table enhancements at §2B1.1(b)(1) add levels based on the amount of loss, which can quickly drive the guideline range upward.

Special enhancements relevant to CFAA cases include:

• Sophisticated means (§2B1.1(b)(10)) — adds 2 levels for sophisticated technical conduct
• Number of victims (§2B1.1(b)(2)) — adds 2 to 6 levels for 10, 50, or 250+ victims
• Stolen personally identifiable information (§2B1.1(b)(17)) — special table for PII and access devices
• Critical infrastructure — enhancements for conduct affecting public safety, healthcare, or critical infrastructure systems
• Abuse of position of trust (§3B1.3) — adds 2 levels for insider misconduct

For sentencing exposure on a specific guideline calculation, the Federal Sentencing Guidelines Calculator at /federal-sentencing-guidelines/ walks through the §2B1.1 loss table and Chapter 3 adjustments.

Texas State-Court Parallel — Penal Code §33.02 Breach of Computer Security

Texas state law has its own computer-crimes statute, Texas Penal Code §33.02 — Breach of Computer Security. The statute prohibits intentionally accessing a computer, computer network, or computer system without the effective consent of the owner. The grade depends on the aggregate amount involved and the conduct:

• Class B misdemeanor — no harm threshold
• Class A misdemeanor — aggregate amount less than $2,500
• State jail felony — aggregate amount $2,500 to less than $30,000, or access to a critical-infrastructure facility computer
• Third-degree felony — aggregate amount $30,000 to less than $150,000
• Second-degree felony — aggregate amount $150,000 to less than $300,000
• First-degree felony — aggregate amount $300,000 or more, or access to a government computer used in administration of justice or critical infrastructure

Texas Penal Code §33.022 — Electronic Access Interference — adds a separate Class B misdemeanor for intentional interruption or suspension of access to a computer or network. Texas has not adopted a state-law analog to Van Buren, and the "effective consent" element under §33.02 can be litigated on similar theories of authorization scope.

Federal and state charges are not mutually exclusive. The same conduct can support both a CFAA prosecution in federal district court and a §33.02 prosecution in Texas state court. Counsel must coordinate defense strategy across both forums when the conduct could be charged in either.