The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030, protects computers in which there is a federal interest—federal computers, bank computers, and computers used in or affecting interstate and foreign commerce. It shields them from trespassing, threats, damage, espionage, and from being corruptly used as instruments of fraud. It is not a comprehensive provision; instead it fills cracks and gaps in the protection afforded by other state and federal criminal laws. It is a work that over the last three decades, Congress has kneaded, reworked, recast, amended, and supplemented to bolster the uncertain coverage of the more general federal trespassing, threat, malicious mischief, fraud, and espionage statutes. This is a brief description of §1030 and its federal statutory companions. There are other laws that address the subject of crime and computers. CFAA deals with computers as victims; other laws deal with computers as arenas for crime or as repositories of the evidence of crime or from some other perspective. These other laws—laws relating to identity theft, obscenity, pornography, gambling, among others—are beyond the scope of this report. In their present form, the seven paragraphs of subsection 1030(a) outlaw computer trespassing in a government computer, 18 U.S.C. 1030(a)(3); computer trespassing resulting in exposure to certain governmental, credit, financial, or computer-housed information, 18 U.S.C. 1030(a)(2); damaging a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce, 18 U.S.C. 1030(a)(5); committing fraud an integral part of which involves unauthorized access to a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce, 18 U.S.C. 1030(a)(4); threatening to damage a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce, 18 U.S.C. 1030(a)(7); trafficking in passwords for a government computer, or when the trafficking affects interstate or foreign commerce, 18 U.S.C. 1030(a)(6); and accessing a computer to commit espionage, 18 U.S.C. 1030(a)(1). Subsection 1030(b) makes it a crime to attempt or conspire to commit any of these offenses. Subsection 1030(c) catalogs the penalties for committing them, penalties that range from imprisonment for not more than a year for simple cyberspace trespassing to imprisonment for not more than 20 years for a second espionage-related conviction and to life imprisonment for death-result offenses. Subsection 1030(d) preserves the investigative authority of the Secret Service. Subsection 1030(e) supplies common definitions. Subsection 1030(f) disclaims any application to otherwise permissible law enforcement activities. Subsection 1030(g) creates a civil cause of action for victims of these crimes. Subsection 1030(h), which has since expired, called for annual reports through 1999 from the Attorney General and Secretary of the Treasury on investigations under the damage paragraph (18 U.S.C. 1030(a)(5)). And subsections 1030(i) and (j) authorize the confiscation of property generated by, or used to facilitate the commission of, one of the offenses under subsection 1030(a) or (b). (a) Whoever ... (3) intentionally, without authorization to access any nonpublic computer of a department or agency of the United States, accesses such a computer of that department or agency that is exclusively for the use of the Government of the United States or, in the case of a computer not exclusively for such use, is used by or for the Government of the United States and such conduct affects that use by or for the Government of the United States ... shall be punished as provided in subsection (c) of this section. (b) Whoever attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section. Paragraph 1030(a)(3) condemns unauthorized intrusion ("hacking") into federal government computers whether they are used exclusively by the government or the government shares access with others. With the help of subsection 1030(b) it also outlaws attempted intrusions and conspiracies to intrude. In the case of shared computers, a crime only occurs if the unauthorized access "affects ... use by or for" the government or would affect such use if an attempted effort had succeeded. Broken down into its elements, paragraph (a)(3) makes it unlawful for anyone to without authorization intentionally either - access a government computer maintained exclusively for the use of the federal government, - access a government computer used, at least in part, by or for the federal government and the access affects use by or for the federal government, - attempts to do so (18 U.S.C. 1030(b)) or - conspires to do so (18 U.S.C. 1030(c)). This pure trespassing proscription dates from 1986 and its legislative history leaves little doubt that nothing more than unauthorized entry is required: "[S]ection 2(b) will clarify the present 18 U.S.C. 1030(a)(3), making clear that it applies to acts of simple trespass against computers belonging to, or being used by or for, the Federal Government. The Department of Justice and others have expressed concerns about whether the present subsection covers acts of mere trespass, i.e., unauthorized access, or whether it requires a further showing that the information perused was 'used, modified, destroyed, or disclosed.' To alleviate those concerns, the Committee wants to make clear that the new subsection will be a simple trespass offense, applicable to persons without authorized access to Federal computers." The paragraph only bans "intentional" trespassing. The reports are instructive here, for they make it apparent that the element cannot be satisfied by a mere inadvertent trespass and nothing more. It is intended, however, to cover anyone who purposefully accomplishes the proscribed unauthorized entry into a government computer, and, at least in the view of the House report, anyone "whose initial access was inadvertent but who then deliberatively maintains access after a non-intentional initial contact." While the question of what constitutes "access without authorization" might seem fairly straightforward, Congress was willing to accept a certain degree of trespassing by government employees in order to protect whistleblowers: The Committee wishes to be very precise about who may be prosecuted under the new subsection (a)(3). The Committee was concerned that a Federal computer crime statute not be so broad as to create a risk that government employees and others who are authorized to use a Federal Government computer would not face prosecution for acts of computer access and use that, while technically wrong, should not rise to the level of criminal conduct. At the same time, the Committee was required to balance its concern for Federal employees and other authorized users against the legitimate need to protect Government computers against abuse by "outsiders." The Committee struck that balance in the following manner. In the first place, the Committee has declined to criminalize acts in which the offending employee merely 'exceeds authorized access' to computers in his own department ("department"' is defined in [s]ection 2(g) of S. 2281 [now 18 U.S.C. 1030(e)(7)]). It is not difficult to envision an employee or other individual who, while authorized to use a particular computer in one department, briefly exceeds his authorized access and peruses data belonging to the department that he is not supposed to look at. This is especially true where the department in question lacks a clear method of delineating which individuals are authorized to access certain of its data. The Committee believes that administrative sanctions are more appropriate than criminal punishment in such a case. The Committee wishes to avoid the danger that every time an employee exceeds his authorized access to his department's computers—no matter how slightly—he could be prosecuted under this subsection. That danger will be prevented by not including "exceeds authorized access" as part of this subsection's offense. In the second place, the Committee has distinguished between acts of unauthorized access that occur within a department and those that involve trespasses into computers belonging to another department. The former are not covered by subsection (a)(3); the latter are. Again, it is not difficult to envision an individual who, while authorized to use certain computers in one department, is not authorized to use them all. The danger existed that S. 2281, as originally introduced, might cover every employee who happens to sit down, within his department, at a computer terminal which he is not officially authorized to use. These acts can also be best handled by administrative sanctions, rather than by criminal punishment. To that end, the Committee has constructed its amended version of (a)(3) to prevent prosecution of those who, while authorized to use some computers in their department, use others for which they lack the proper authorization. By precluding liability in purely 'insider' cases such as these, the Committee also seeks to alleviate concerns by Senators Mathias and Leahy that the existing statute cases a wide net over "whistleblowers".... The Committee has thus limited 18 U.S.C. 1030(a)(3) to cases where the offender is completely outside the Government, and has no authority to access a computer of any agency or department of the United States, or where the offender's act of trespass is interdepartmental in nature. The Committee does not intend to preclude prosecution under this subsection if, for example, a Labor Department employee authorized to use Labor's computers accesses without authorization an FBI computer. An employee who uses his department's computer and, without authorization, forages into data belonging to another department is engaged in conduct directly analogous to an 'outsider' tampering with Government computers.... The Committee acknowledges that in rare circumstances this may leave serious cases of intradepartmental trespass free from criminal prosecution under (a)(3). However, the Committee notes that such serious acts may be subject to other criminal penalties if, for example, they violate trade secrets laws or 18 U.S.C. 1030(a)(1), (a)(4), (a)(5), or (a)(6), as proposed in this legislation. Trespassing upon governmental computer space on computers that are not exclusively for governmental use is prohibited only when it affects use by the government or use for governmental purposes. The committee reports provide a useful explanation of the distinctive, "affects-the-use" element of the trespassing ban: [T]respassing in a computer used only part-time by the Federal Government need not be shown to have affected the operation of the government as a whole. The Department of Justice has expressed concerns that the present subsection's language could be construed to require a showing that the offender's conduct would be an exceedingly difficult task for Federal prosecutors. Accordingly, [s]ection 2(b) will make clear that the offender's conduct need only affect the use of the Government's operation of the computer in question [or the operation of the computer in question on behalf of the Government]. S.Rept. 99-432 at 6-7 (1986); see also, H.Rept. 99-612 at 11 (1986); S.Rept. 104-357 at 9 (1996). The reports offer little insight into the meaning of the third element—what computers are protected from trespassing. There may be two reasons. Paragraph 1030(a)(3) protects only government computers and therefore explanations of the sweep of its coverage in the area of interstate commerce or of financial institutions are unnecessary. Besides, at least for purposes of these trespassing offenses of paragraph 1030(a)(3), the statute itself addresses several of the potentially more nettlesome questions. First, the construction of the statute itself strongly suggests that it reaches only computers owned or leased by the federal government: "whoever ... without authorization to access any nonpublic computer of a department or agency of the United States , accesses such a computer of that department or agency ...." Second, the language of the statute indicates that "nonpublic" computers may nevertheless include government computers that the government allows to be used by nongovernmental purposes: "in the case of a [government] computer not exclusively for the use of the Government of the United States ...." Third, the statute covers government computers that are available to nongovernment users: "accesses such a computer ... that ... in the case of a [government] computer not exclusively for the use of the Government of the United States, is used by or for the Government of the United States...." The use of the term "nonpublic," however, makes it clear that this shared access may not be so broad as to include the general public. Finally, the section supplies a definition of "department of the United States": "[a]s used in this section ... the term 'department of the United States' means the legislative or judicial branch of the Government or one of the executive departments enumerated in [s]ection 101 of title 5"; and the title supplies a definition of "agency of the United States": "[a]s used in this title ... [t]he term 'agency' includes any department, independent establishment, commission, administration, authority, board or bureau of the United States or any corporation in which the United States has a proprietary interest, unless the context shows that such term was intended to be used in a more limited sense." There is one jurisdictional aspect of paragraph 1030(a)(3) that is unclear. Under what circumstances, if any, does the paragraph reach hacking initiated or occurring overseas? As a general rule, federal laws are presumed to apply within the United States and not overseas. In some instances, Congress explicitly negates the presumption. The treason statute, for example, outlaws the offense whether committed "within the United States or elsewhere." In other instances, when the criminal statute is silent, the courts will conclude that Congress must have intended the statute to apply to overseas misconduct because of the nature of the offense and the circumstances under which it was committed. For example, the Supreme Court concluded that Congress must have intended the federal statute that prohibited fraud against the federal government to apply to fraud against the United States committed abroad, particularly when the offenders were Americans. The Court later decided that a federal statute that outlawed conspiracy to violate federal law applied to an overseas conspiracy to smuggle liquor into this country. In the cybercrime context, at least one court determined that paragraph 1030(a)(4), which prohibits unauthorized computer access to defraud, applied to a hacker in Russia who gained unauthorized access to "protected computers" in this country. The court's conclusion was influenced by an amendment in which Congress had added computers used in "foreign commerce or communications" to the definition of "protected computers" and by the legislative history of why it did so. While the case was pending, Congress further amended the definition of "protected computer" to include "a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States." Paragraph 1030(a)(3) does not cover "protected computers"; it covers nonpublic, federal government computers. Congress explicitly provided extraterritorial jurisdiction over the computer-related information acquisition, fraud, damage, and extortion offenses by amending the definition of protected computer. It provided no such explicit provision for simple trafficking offense under paragraph 1030(a)(3). A court might conclude that Congress meant both to grant extraterritorial application in computer-related information acquisition, fraud, damage, and extortion cases under paragraphs 1030(a)(2), (4), (5), and (7) and to foreclose extraterritorial application in simple trespassing cases under paragraph 1030(a)(3)—even under circumstances when the courts would have otherwise found it appropriate in a simple trespassing case. The penalties for conspiracy to violate, or for violations or attempted violations of, paragraph 1030(a)(3) are imprisonment for not more than one year and/or a fine of not more than $100,000 ($200,000 for organizations) for the first offense and imprisonment for not more than 10 years and/or a fine of not more than $250,000 ($500,000 for organizations) for all subsequent convictions. Offenses under other paragraphs may trigger forfeiture, restitution, racketeering, money laundering, sentencing guidelines, and civil liability provisions elsewhere in the law. For reasons that will become apparent when they are discussed later in this report, those provisions have little, if any, relevance in case of simple trespassing offenses under paragraph 1030(a)(3). The forfeiture provisions of subsections 1030(i) and (j), however, do authorize the confiscation of a cyber trespasser's computer and any other property that facilitated the offense. Historically, federal authorities did not prosecute juvenile offenders. Most federal crimes, including computer hacking, are crimes under the laws of most states. When a juvenile violates a federal law, he must be turned over to state juvenile authorities unless the state is unwilling or unable to proceed against him, or unless the state has inadequate facilities for his treatment, or unless the crime is a violent federal felony or a federal drug or firearms offense. Paragraph 1030(a)(3) has remained essentially unchanged since 1986, and there appear to have been relatively few prosecutions under its provisions. The explanation may be that paragraph 1030(a)(3) tracks paragraph 1030(a)(2) so closely that the prosecution is ordinarily reserved for the more serious cases which warrant the more serious felony sanctions available under the information acquisition offense of paragraph 1030(a)(2), but not the simple trespassing offense of paragraph 1030(a)(3). An attempt to hack into a federal computer in violation of paragraph 1030(a)(3) is also punishable as a federal crime, 18 U.S.C. 1030(b). In fact, subsection 1030(b) punishes as a federal crime any attempt to violate any of the paragraphs of subsection 1030(a). The subsection dates from the original enactment and evokes no comment in the legislative history other than the notation of its existence. This is not particularly unusual. There is no general federal attempt statute, but Congress has elected to penalize attempts to commit many individual federal crimes. A body of case law has grown up around them that provides a common understanding of their general dimensions. Thus, as a general rule, in order to convict a defendant of attempt, the government must prove beyond a reasonable doubt that, acting with the intent required to commit the underlying offense, the defendant took some substantial step towards the commission of the underlying offense that strongly corroborates his criminal intent. Mere preparation does not constitute a substantial step. The line between preparation and a substantial step towards final commission depends largely upon the facts of a particular case, and the courts have offered varying descriptions of its location. Conspiracy to violate any federal law is a separate federal crime. Thus, if two or more individuals agree to intentionally access a government computer without authorization and one of them takes some affirmative action to effectuate their plan, each of the individuals is guilty of conspiracy under this general conspiracy statute, regardless of whether the scheme is ultimately successful. If one of the conspirators manages to "hack" into a government computer, he and his coconspirators may all be prosecuted for violating paragraph 1030(a)(3). The general conspiracy statute notwithstanding, subsection 1030(b) declares that conspiracy to commit any of the subsection 1030(a) offenses shall be punished as provided in subsection (c), which delineates the punishment for each of the subsection 1030(a) offenses. The principles that apply to prosecution under the general conspiracy statute apply with equal force to prosecution under subsection 1030(b), with two exceptions. Section 371 general conspiracy prosecutions require proof of an overt act in furtherance of the scheme, subsection 1030(b) conspiracy prosecutions do not. There is a second difference. Section 371 punishes conspiracy to commit any federal felony with imprisonment for not more than 5 years, regardless of the maximum term of imprisonment that attends the underlying substantive offense. The section declares that the punishment for conspiracy to commit any federal misdemeanor may not exceed the maximum penalty for the underlying misdemeanor. Subsection 1030(b), on other hand, seems to contemplate punishing alike conspiracy and underlying violation of subsection 1030(a): "Whoever conspires to commit or attempts to commit an offense under subsection (a) of this section shall be punished a provided in subsection (c) of this section [which establishes the punishment for violating the various paragraphs of subsection 1030(a)]." Anyone who counsels, commands, aids or abets, or otherwise acts as an accessory before the fact with respect to any federal crime is liable as a principal for the underlying substantive offense to the same extent as the individual who actually commits the offense. More than mere inadvertent assistance is required; but an accomplice who embraces the criminal objectives of another and acts to bring about their accomplishment is criminally liable as a principal for the completed offense. The fact that subsection 1030(b) outlaws attempts to violate any of the prohibitions of subsection 1030(a) raises an interesting question concerning accessories. As a general rule, an accomplice may only be liable as a principal or accessory before the fact, for a completed crime; the aid must be given before the crime is committed, but liability as a principal will not attach until after the crime has been committed. This does not bar conviction of one who aids or abets the commission of a crime that never succeeds beyond the attempt phase, if, as in the case of paragraph 1030(a)(3), attempt to commit the offense has been made a separate crime. Beyond these auxiliary offenses and bases for criminal liability, the simple trespassing crime created in paragraph 1030(a)(3) is the least likely of the seven crimes established in subsection 1030(a) to share coverage with other laws outside the section. Simply hacking into government computers—without damage to the system, injury to the government, or gain by the hacker—implicates only a few other laws. Computer trespassing in one form or another is an element of most of the offenses proscribed in 18 U.S.C. 1030. Moreover, hacking into someone else's e-mail stored in a government computer system is likely to offend the federal statute that protects e-mail and stored telephone company records, 18 U.S.C. 2701. Hackers who misidentify themselves in order to gain access to a federal computer may be guilty of violating 18 U.S.C. 1001 and 18 U.S.C. 912, in the view of at least one commentator. The case law may make the claim difficult to defend. The Supreme Court has suggested that §1001 should be constructed narrowly, and the courts have consistently held that the false statement must somehow tend to adversely impact the functioning of a governmental agency or department to trigger coverage under §1001. Cases in other contexts demonstrate the difficulty of convincing the courts that simple trespassing in government cyberspace has an adverse impact upon the government. The difficulty with using the impersonation statute, 18 U.S.C. 912, is that it requires a showing of an official act or of a fraud, something that need not be proven for conviction under paragraph 1030(a)(3). Like 18 U.S.C. 1001, §912 may be more appropriately employed in cases falling under the ambit of paragraph 1030(a)(4) (unauthorized access of a government computer, bank computer, or computer in interstate or foreign commerce as integral part of a scheme to fraud). Simple computer trespassing is also a crime under the anti-hacking laws of most of the states. (a) Whoever ... (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains (A) information contained in a financial record of a financial institution, or of a card issuer as defined in [s]ection 1 602(n) of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.); (B) information from any department or agency of the United States; or (C) information from any protected computer ... shall be punished as provided in subsection (c) of this section. (b) Whoever attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section. One step beyond simple hacking is the prohibition against acquiring certain protected information by intentional unauthorized computer access. As a practical matter, in any instance involving a government computer it may be very difficult to distinguish between cases evidencing a violation of the simple trespass proscriptions of paragraph 1030(a)(3) and the trespassing-with-information-acquisition prohibitions of paragraph 1030(a)(2). The history of the trespass provisions speaks clearly of an intent to place beyond their reach whistleblowers and other federal employees for simple trespassing with respect to computers within their own agency. This explains the absence of an "exceeds-authorized-access" provision in the trespassing provisions of paragraph 1030(a)(3). But the trespass-and-be-exposed-to-information provisions of paragraph 1030(a)(2) do feature a "exceeds-authorized-access" clause and seem facially applicable to whistleblowers. It remains to be seen whether the courts will read paragraph 1030(a)(2) as effectively amending the simple trespassing provisions of paragraph 1030(a)(3) or will attempt to reconcile the two. In any event, to sustain a conviction under paragraph 1030(a)(2), "the Government must prove that the defendant (1) intentionally (2) accessed without authorization (or exceeded authorized access to) a (3) protected computer and (4) thereby obtained information." The intent requirement is the same as that required in the case of simple trespassing. The offender must have "intentionally" gained access. The paragraph only bans "intentional" trespassing. As in the case of simple trespassing the intent element can be satisfied by anyone who purposefully gains access to a computer covered by the paragraph or by anyone "whose initial access was inadvertent but who then deliberatively maintains access after a non-intentional initial contact." Moreover, the government need not show that the trespass was committed to defraud or for any other purpose for that matter. Thus far, the courts have experienced some difficulty applying the terms "without authorization" and "exceeds authorized access" as used in paragraph 1030(a)(2) and the other paragraphs of 18 U.S.C. 1030, even though the statute supplies a specific definition of the term "exceeds authorized access." Some have applied the terms to access by authorized employees who use their access in any unauthorized manner or for unauthorized purposes and to access by outsiders who have been granted access subject to explicit reservations. Others have concluded that "a person who 'intentionally accesses a computer without authorization' §§1030(a)(2) and (4), accesses a computer without any permission at all, while a person who 'exceeds authorized access,' id. , has permission to access the computer, but accesses information on the computer that the person is not entitled to access." One court concluded that the conscious breach of MySpace's terms of service could "potentially constitute accessing the MySpace computer/server without authorization and/or in excess of authorization." The court, however, went on to find the section unconstitutionally vague under such a construction, "if any conscious breach of a website's terms of service is held to be sufficient by itself to constitute intentionally accessing a computer without authorization or in excess of authorization, the result will be that section 1030(a)(2)(C) becomes a law 'that affords too much discretion to the police and too little notice to citizens who wish to use the [Internet].'" Paragraph 1030(a)(2) is at once more and less restricted than the simple trespassing proscription of paragraph 1030(a)(3). On one hand, its prosecution requires more than a simple trespass. On the other hand, it covers a wider range of computers. Paragraph 1030(a)(2), unlike 1030(a)(3), covers more than government computers. It covers computers from which three types of information may be obtained—information of the federal government, consumer credit or other kinds of financial information, and information acquired from a protected computer. The protection for financial information has its origins in the initial legislation and was among the first adjusted. Comments from the Senate report accompanying the 1986 amendments illustrate the intended scope of the protection for financial information: "The premise of 18 U.S.C. 1030(a)(2) will remain the protection, for privacy reasons, of computerized credit records and computerized information relating to customers' relationships with financial institutions. This protection is imperative in light of the sensitive and personal financial information contained in such computer files. However, by referring to the Right to Financial Privacy Act, the current statute limits its coverage to financial institution customers who are individuals, or are partnerships with five or fewer partners. The Committee intends ... to extend the same privacy protections to the financial records of all customers—individual, partnership, or corporate—of financial institutions. "The Department of Justice has expressed concerns that the term 'obtains information' in 18 U.S.C. 1030(a)(2) makes that subsection more than an unauthorized access offense, i.e., that it might require the prosecution to prove asportation of the data in question. Because the premise of this subsection is privacy protection, the Committee wishes to make clear that 'obtaining information' in this context includes mere observation of the data. Actual asportation, in the sense of physically removing the data from its original location or transcribing the data, need not be proved in order to establish a violation of this subsection," S.Rept. 99-432 at 6-7 (1986). The committee explanation of the language amending paragraph 1030(a)(2), ultimately enacted as part of the Economic Espionage Act of 1996, endorsed this reading and extended it to cover information obtained from federal computers and information secured by interstate or overseas cyberspace trespassing: "'Information' as used in this subsection [1030(a)(2)] includes information stored in intangible form. Moreover, the term 'obtaining information' includes merely reading it. There is no requirement that the information be copied or transported. This is critically important because, in an electronic environment, information can be 'stolen' without asportation, and the original usually remains intact. This interpretation of 'obtaining information' is consistent with congressional intent expressed ... in connection with 1986 amendments to the Computer Fraud and Abuse statute.... "The proposed subsection 1030(a)(2)(C) is intended to protect against the interstate or foreign theft of information by computer. This information, stored electronically, is intangible, and it has been held that the theft of such information cannot be charged under more traditional criminal statutes such as Interstate Transportation of Stolen Property Act, 18 U.S.C. 2314. See United States v. Brown , 925 F.2d 1301, 1308 (10 th Cir. 1991). This subsection would ensure that the theft of intangible information by the unauthorized use of a computer is prohibited in the same way theft of physical items are protected. In instances where the information stolen is also copyrighted, the theft may implicate certain rights under the copyright laws. The crux of the offense under subsection 1030(a)(2)(C), however, is the abuse of a computer to obtain the information," S.Rept. 104-357 at 6-7 (1996). The Identity Theft Enforcement and Restitution Act of 2008 expanded the reach of paragraph 1030(a)(2) when it eliminated the requirement that the forbidden access "involve[] an interstate or foreign communication" and then redefined "protected computer" to include computers "affecting" interstate or foreign commerce. The elimination permits authorities to "address the increasing number of computer hacking crimes that involve computers located within the same state." The expansion from computers used in interstate or foreign commerce to computers used in or affecting such commerce extends coverage beyond computers with an interstate Internet connection and appears to encompass any freestanding or other computer that has at least a de minimis impact on commerce. A computer that accesses the Internet is a computer used in interstate or foreign commerce. The earlier USA PATRIOT Act amendment of the definition of "protected computer" confirmed Congress's intent to proscribe unauthorized access and information acquisition from abroad with respect to protected computers. A closer question may be whether in doing so it forecloses extraterritorial application of paragraph 1030(a)(2) in other situations, for example , unauthorized access to federal computer or computer networks located overseas. The simple trespass offenses condemned in paragraph 1030(a)(3) are unlikely to significantly implicate the Sentencing Guidelines, restitution, forfeiture, or civil liability provisions elsewhere in the law. Not so paragraph 1030(a)(2) offenses. Criminal penalties attend it, but so do other consequences. Paragraph 1030(a)(2) has a three tier sentencing structure. Simple violations are punished as misdemeanors, imprisonment for not more than one year and/or a fine of not more than $100,000 ($200,000 for organizations). The second tier carries penalties of imprisonment for not more than five years and/or a fine of not more $250,000 ($500,000 for organizations) and is reserved for cases in which "(i) the offense was committed for purposes of commercial advantage or private financial gain; (ii) the offense was committed in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or of any State; or (iii) the value of the information obtained exceeds $5,000." This second level was added in 1996. With respect to the alternative thresholds, (i) and (ii), "[t]he terms 'for purposes of commercial advantage or private financial gain' and 'for the purpose of committing any criminal or tortious act' are taken from the copyright statute (17 U.S.C. 506(a)) and the wiretap statute (18 U.S.C. 2511[(2)] (d)), respectively, and are intended to have the same meaning as in those statutes." The references to copyright and wiretap law may be less instructive than Congress anticipated for the phrases in question are of uncertain meaning in their original settings. Nevertheless, the phrases seems to contemplate some criminal, tortious, or financially advantageous purpose beyond the computer-trespassing-and-obtaining-information misconduct outlawed in the paragraph generally. Otherwise nothing would be left to be punished as a misdemeanor and the $5,000 distinction of exception (iii) would be swallowed up as well. As for exception (iii), the value of information acquired by a hacker may not always be easily ascertained. In the absence of evidence of fair market value, one appellate court approved the district court's use of the cost of production to assess the value of information acquired in violation of subsection 1030(a)(2). It suggested, however, any calculation reasonable under the circumstances might be acceptable. The third tier is for repeat offenders whose punishment is increased to imprisonment of not more than 10 years and/or a fine of not more than $250,000 ($500,000 for organizations) for a second or subsequent conviction. Federal law is no more hospitable to the prosecution of juveniles for the intrusion plus information acquisition offenses under paragraph 1030(a)(2) than it is for the simple trespass offenses under paragraph 1030(a)(3). Essentially, federal proceedings are only possible if the state in which the offense occurs is unwilling or unable to proceed. The Sentencing Guidelines color the procedure under which the penalties for serious federal crimes are imposed. They were established to eliminate sentencing disparity among cases involving the same offense and to ensure that the sentences imposed reflect the relative seriousness of the circumstances under which the offense was committed in a given case. As a general rule, the Guidelines assign each federal crime to a particular guideline. The individual guideline in turn assigns a beginning number (base offense level) and then adds and subtracts from that number based on the presence of designated aggravating or mitigating circumstances. The final total translates to an authorized sentencing range in months of imprisonment and dollars of fines. Violations of paragraph 1030(a)(2) are governed by U.S.S.G. §2B1.1 which sets the base offense level at 6. The Tenth Circuit's opinion in Willis provides an example of the process from that point: The District Court agreed with the Government and found Ms. Fischer's conduct [which resulted in losses of more than $10,000] foreseeable to [her accomplice] Mr. Willis. It therefore imposed a 4-level enhancement on Mr. Willis's base offense level. It also applied the §2B1.1(b)(10)(C)(i) enhancement because the offense involved using a means of identification to produce another means of identification, as well as the §3B1.3 enhancement because Mr. Willis abused a position of trust. This produced an adjusted offense level of 14, which when coupled with his criminal history category of V, resulted in an advisory Guideline range of 33 to 41 months. The District Court sentenced Mr. Willis to 41 months' imprisonment. Although not mentioned in Willis , the Guidelines now add 2-6 offense levels if the offense involves a critical infrastructure computer and 2 levels if the information acquired is personal information. Under the general forfeiture provisions, "[a]ny property, real or personal, which constitutes or is derived from proceeds traceable, to a violation of section ... 1030" is subject to confiscation by the United States under either the general civil or criminal forfeiture provisions. The Identity Theft Enforcement and Restitution Act of 2008 inserted separate criminal and civil forfeiture subsections within §1030. Section 1030 now authorizes confiscation pursuant to criminal procedure both real and personal property derived from a violation of §1030, as well as any personal property used or intended to be used to facilitate such a violation. Restitution is victim compensation for loss or damage associated with the offense. Federal courts must order a convicted defendant to pay restitution in the case of (i) a federal crime of violence, or (ii) federal crime involving fraud or property damage, or (iii) a crime in which the victim suffers physical injury or pecuniary loss. It is within the discretion of the court to order restitution in the case of all other federal crimes proscribed in Title 18 of the United States Code . Paragraph 1030(a)(2) acquisition offenses are not crimes of violence and restitution is therefore not mandatory on those grounds. There, they come within the discretionary restitution provisions, but those provisions have a limitation on the type of losses for which restitution may be ordered. The limitation, however, does not apply in the case of a plea bargain or when restitution is ordered as a condition of probation or supervised release. On the other hand, the court may be required to order restitution when the victim of the defendant's computer security breach suffers a pecuniary loss associated with its investigation of the breach. Subsection 1030(g) creates a cause of action for compensatory damages and injunctive relief for the benefit of victims of any §1030 violation, but only if violation results in the kind of loss or damage described in clauses 1030(c)(4)(A)(i)(I) through (V), that is: (I) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value; (II) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals; (III) physical injury to any person; (IV) a threat to public health or safety; (V) damage affecting a computer system used by or for a government entity in furtherance of the administration of justice, national defense, or national security; (VI) damage affecting 10 or more protected computers during any 1-year period. There is no need to prove that a violation of paragraph 1030(a)(5) has occurred. As long as this type of loss or damage has been suffered, a violation of any of the paragraphs will suffice, including a violation of paragraph 1030(a)(2). Moreover, some courts have held that victims may join their losses together to reach the $5,000 threshold of subclause 1030(c)(4)(A)(i)(I), at least as long as the same defendant caused the same damage in the same manner to each. At one time there may have been some uncertainty over the range of victims and losses envisioned in subsection 1030(g). Victims entitled to relief are described as "any person who suffers loss or damage by reason of a violation of this section," but until recently there was no specific definition of the term "person" in either any of the subsections of 1030 or in the generally applicable definitions of Title 18. The legislative history offered no further edification and the courts had not addressed the issue. "Person" can mean individuals, or individuals and other legal entities including governmental entities, or individuals and other legal entities but not including governmental entities. Credible arguments might have been made for each of the possible definitions, but the fact that Congress elected to use the term "person" to mean only individuals in paragraph 1030(a)(7)(extortionate threats) might seem to favor those who call for a similar interpretation of subsection 1030(g). The USA PATRIOT Act resolved the issue by supplying a definition: "the term 'person' means any individual, firm, corporation, educational institution, governmental entity, or legal or other entity." It also added a generous definition of the kinds of losses that might give rise to civil liability—"the term 'loss' means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." The amendment has obvious benefits for the victims of a paragraph (a)(2) intrusion and information acquisition offense with post-intrusion investigation and system evaluation costs. Subsection 1030(g) suits must be brought within two years of the offense. Compensatory damages are limited to economic damages, a limitation that does not negate the reach of the broad definition of the term "loss" quoted above. The same general observations concerning attempt, conspiracy, and aiding and abetting noted for the simple trespass offense apply here. It is a separate crime to attempt or conspire to violate paragraph 1030(a)(2) under 18 U.S.C. 1030(b). Those who conspire or attempt to violate its provisions or aid and abet the violation of another are subject to the same penalties as those who commit the substantive offense. Conspirators to violate paragraph 1030(a)(2) are also subject to the same penalties for a completed underlying offense, and to liability for any foreseeable crime committed in furtherance of the scheme. Paragraph 1030(a)(2) is somewhat unique. There are a host of other federal conversion statutes, but all of the others appear to require that the offender either commit embezzlement by failing to comply with some fiduciary obligation or commit larceny by intending to acquire the property or to deprive another of it. Paragraph 1030(a)(2) in contrast to the conversion statutes and to the computer fraud provisions of paragraph 1030(a)(4) requires no larcenous intent. As a practical matter, it essentially gives prosecutors a more serious charge against hackers, who do more than simply breach the outskirts of a governmental system, than would be available under the pure trespassing provisions of paragraph 1030(a)(3). And it gives the government an alternative or additional charge, along with conversion and fraud statutes, against hackers who "steal" information from a protected computer. It affords victims similar latitude in civil litigation under subsection 1030(g). Paragraph 1030(a)(2) is essentially paragraph 1030(a)(3) plus an information acquisition element and a broader jurisdictional base. When the defendant gains access to the computer by means of a false statement, paragraph 1030(a)(2) may overlap with the various false statement and false idenfication statutes such as 18 U.S.C. 1001 (false statements on a matter with the jurisdiction of a federal agency) and 18 U.S.C. 912 (impersonating a federal official). By the same token, paragraph 1030(a)(2) may overlap with the communication protection provisions of 18 U.S.C. 2511 (wiretaping) and 18 U.S.C. 2701 (stored communications), when the defendant's unauthorized computer access intrudes upon on-going or stored wire or electronic communications (i.e., phone calls, e-mails, or data). Overlap is even more likely than in the case of paragraph 1030(a)(3), since paragraph 1030(a)(3) protects only federal computers. Paragraph 1030(a)(2) protects not only federal computer information, but information from "protected computers" (computers used in or affecting interstate and foreign commerce). Due to the nature of Internet communications, a communication may involve interstate communications even if both the parties are located within the same state. Moreover, a computer need only have a slight impact on commerce to satisfy the "affect on interstate or foreign commerce" element. By virtue of an amendment in the USA PATRIOT Act, protected computer information may include information on computers located overseas as long as they involve or affect the foreign commerce or communications of the United States. Whether a hacker, who steals information stored in a computer, violates any of the general federal theft statutes depends upon whether the particular statute covers intangible property, and if not, whether the victim has been defrauded of tangible, in addition to intangible, property. For instance, the Supreme Court has noted that 18 U.S.C. 2314, that outlaws the interstate transportation of stolen goods, wares, or merchandise, "contemplate[s] a physical identity between the items unlawfully obtained and those eventually transported." Thus, the theft of information stored in a computer may be prosecuted under §2314 only if the government can establish that it was accomplished in conjunction with the theft and transportation of a physical item. Downloading information onto a stolen computer disk and then transporting the disk across a state line is covered, yet downloading information onto a computer disk that is transported but not stolen is not covered. Prosecuting computer intrusions under a statute that outlaws the interstate transportation of stolen "goods, wares, merchandise, securities or money" may seem an awkward fit. The general theft of government property statute, 18 U.S.C. 641, may appear a better match, for that provision outlaws the misappropriation of any "thing of value" belonging to or in the possession of the federal government. A §641 conviction requires the government to prove that: "(1) the defendant stole or converted something of value for his own use; (2) the thing of value belonged to the United States; and (3) the defendant did so knowingly and with the intent to deprive the owner of the use or benefit of the [thing of value]." The courts have applied §641 to the misappropriation of property that lacks any necessary corporal features. Paragraph 1030(a)(2) overlaps with the Economic Espionage Act when the information acquired through unauthorized access is a trade secret. The Economic Espionage Act, among other things, outlaws computerized burglary committed in a commercial setting. It makes it a federal crime to steal certain trade secrets, or to receive such trade secrets with the knowledge they have been stolen, or to conspire or attempt to steal them, or to conspire or attempt to receive them knowing they have been stolen. To be covered by the protective umbrella of the section, information must (1) have a nexus interstate or foreign commerce; (2) be a secret; and (3) have some trade value. Information meets the commerce nexus when it is "related to or included in a product or service used in or intended for use in interstate or foreign commerce." Information is considered "secret" if it is "not generally known to the public or to the business, scientific, or education community in which [its] owner might seek to use the information" and its owner takes reasonable steps to maintain its confidentiality. But what makes the economic espionage section a particularly effective shield against computerized burglary in a commercial setting is that the trade secret information it protects includes "all forms and types of financial, business, scientific, technical, economic, or engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processes, procedures, programs, or codes, whether tangible or intangible, and whether or how stored, compiled, or memorialized physically, electronically, graphically, photographically, or in writing." Violations of the economic espionage provisions are punishable by imprisonment for not more than 10 years and/or a fine of not more than the greater of twice the amount of pecuniary gain or loss resulting from the offense or $250,000 (not more than $5 million if the offender is an organization). Downloading information after unauthorized access to a protected computer may violate not only paragraph 1030(a)(2) but may implicate copyright law as well. Computer software programs are ordinarily protected by copyright which generally precludes copying of protected material without the consent of the holder of the copyright. Copyright law outlaws three forms of willful copyright infringement: (A) infringement for "commercial advantage or private financial gain"; (B) infringement by reproduction of distribution of protected works worth more than $1,000; and (C) infringement by "distribution of a work being prepared for commercial distribution, by making it available on a computer network accessible to members of the public, if such person knew or should have known that the work was intended for commercial distribution." Each of the three forms of infringement has its own penalty structure under 18 U.S.C. 2319. Infringement for profit or commercial advantage is punishable by prison terms with maximum limits of 1 to 10 years depending on the extent of the violation. The maximum term of imprisonment for infringement on works worth more than $1,000 ranges from 1 to 6 years. Finally, the infringement involving works in preparation for distribution carries maximum penalties ranging from 3 to 10 years. The offenses are also subject to fines of not more than $250,000 (not more than $500,000 for organizations) if the maximum term of imprisonment is more than 1 year, and otherwise of not more than $100,000 (not more than $200,000 for organizations). The principal federal money laundering statutes, 18 U.S.C. 1956 and 1957, outlaw various financial activities that involve the proceeds from other federal crimes. They prohibit domestic laundering of the proceeds of these predicate offenses, referred to as "specified unlawful activities"; international laundering of the proceeds of predicate offenses; using the proceeds of predicate offenses to promote further predicate offenses; or spending or depositing more than $10,000 of the proceeds of predicate offenses. Offenses under the various paragraphs of 18 U.S.C. 1030 are all money laundering predicate offenses, although paragraph 1030(a)(2) information acquisition offenses are less likely to generate proceeds than are the fraud and espionage offenses of paragraphs 1030(a)(4) and 1030(a)(1). Whoever ... (5)(A) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; ( B ) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or ( C ) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss. (b) Whoever attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section. Paragraph 1030(a)(5) establishes crimes of dual intent the intent to knowingly or intentionally intrude and the intent to damage. Paragraph 1030(a)(5) establishes three computer damage offenses, distinguishable on the basis of the offender's intent to intrude and cause damage: (A) intentionally causing damage without authorization to a protected computer through a knowing transmission ; (B) recklessly causing damage to a protected computer by intentional unauthorized access; and (C) causing damage and loss to a protected computer by intentional unauthorized access. This feature, added in 1996 and amended in the USA PATRIOT and Homeland Security Acts, preserves the earlier understanding that anyone who intentionally secures unauthorized access is punishable for any resulting damage regardless of whether he intended to cause it, or was recklessly indifferent as to whether he did so. When subparagraph 1030(a)(5)(A) proscribes knowing transmission rather than the intentional access proscribed in subparagraphs 1030(a)(5)(B) and (C), it reaches the both the direct and indirect infliction of damage. To establish the transmission element of the intentional damage offense in subparagraph 1030(a)(5)(A), "the government must offer sufficient proof that the person charged is the same person who sent the transmission. Circumstantial evidence is sufficient to prove that the transmission occurred." Moreover, transmission includes installation of a destructive program. Transmission need only be done knowingly, but the damage must be done intentionally. That is, the defendant must be shown to have to caused the transmission "with the conscious purpose of causing damage." Where the other paragraphs of 18 U.S.C. 1030 speak of unauthorized access, they mention "exceeding authorized access" as an alternative. Subparagraph 1030(a)(5)(B) and (C) reckless and simple provisions do not; they speak only of unauthorized access. The difference has been construed to mean that only outsiders may violate the reckless and simple damage clauses. Damage is the element common to any of paragraph 1030(a)(5)'s offenses. The Identity Theft Enforcement and Restitution Act rewrote the damage offenses of paragraph 1030(a)(5). Prior to amendment, the paragraph only reached cases involving serious damage, which it punished as felonies when the harm was intentionally or recklessly caused and as a misdemeanor in simple damage cases. Intentionally or recklessly causing serious computer damage is still covered and treated as a felony, but now intentionally or recklessly causing less serious computer damage is also covered and treated as a misdemeanor. Simple damage is still treated as a misdemeanor, but unlike its companions for which proof of damage alone is sufficient the subparagraph 1030(a)(5)(C) simple damage offense requires proof of both damage and loss. Damage is defined as "any impairment to the integrity or availability of data, a program, a system, or information." Qualifying damage thus encompasses not only destruction but diminished availability. Violation of paragraph 1030(a)(2)(hacking and acquiring information) alone is not enough. Loss is described as "any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." The crimes of paragraph 1030(a)(5) have no "exceeds authorization" element. Instead, they condemn transmission that causes unauthorized damage; unauthorized access that recklessly causes damage; and unauthorized access that causes damage and loss. A defendant who has been granted access cannot be said to have gained unauthorized access though his use may have exceeded the purposes for which authorization granted. Computer damage is only a federal crime under paragraph 1030(a)(5), however, if it involves a "protected computer." Five types of computers or computer systems are "protected." The five include those used exclusively for or by the United States government; used exclusively for or by a bank or other financial institution; used in part for or by the United States government where the damage "affects" the government use or use on the government's behalf; used in part for or by a bank or other financial institution where the damage "affects" use by or on behalf of the institution; and used in or affecting interstate or foreign commerce or communications including a computer outside the country whose use affects U.S. commerce. What is a "computer ... used in interstate or foreign commerce or communications"? The legislative history shows that the phrase means computer damage which might affect interstate or foreign commerce or interstate or foreign communications. The phrase appears in §1030 after the 1994 amendments when it was first used to supplement (and in the 1996 amendments to replace) the phrase "computer ... which is one of two or more computers used in committing the offense, not all of which are located in the same State." The change was made because under the earlier language "hackers who attacked other computers in their own State were not subject to Federal jurisdiction, notwithstanding the fact that their actions may have severely affected interstate or foreign commerce. For example, individuals who attack[ed] telephone switches m[ight] disrupt interstate and foreign calls. The 1994 change remedied that defect." The inherently interstate nature of the Internet is such that a computer used to access the Internet is a computer used in interstate or foreign commerce, and consequently a computer whose protection is within Congress's power to regulate. A computer "affecting interstate or foreign commerce" need apparently have no Internet connection nor be part of any interstate communications network. If the phrase is given its ordinary meaning, no more is required than that the computer or computer system have some slight impact on interstate or foreign commerce. This seems to have been the intent of its sponsors. Precisely which government computers are protected is a bit more uncertain. Although terms used elsewhere in §1030 such as "governmental entity" and "department of the United States" are expressly defined, there is no definition of either the phrase "United States Government" or the phrase "Government of the United States" used from the beginning to describe the scope of protection provided federal computers. The reports do not explain its meaning. In the trespassing provisions of paragraph 1030(a)(3), however, the phrase is used in juxtaposition with the phrase "department or agency of the United States" suggesting that the term embodies the meaning assigned to that phrase by the definition subsection of §1030 and by the definition section generally applicable to Title 18 of the United States Code . On the other hand, it would not be unreasonable for a court to conclude that the phrases "United States Government" and "Government of the United States" should be construed narrowly since when Congress intended an expansive definition it provided one. The definition of financial institutions whose computers are protected differs only slightly from the definition generally applicable in Title 18. The question persists as to whether by specifically mentioning overseas computers in the interstate and foreign commerce basis for jurisdiction ("including a computer outside the country whose use affects U.S. commerce"), Congress intended to preclude overseas application of the other bases for jurisdiction (e.g., damage to government computers). The paragraph punishes causing serious damage recklessly or intentionally inflicted more severely than causing damage without necessarily intending to do so or than causing less serious damage intentionally or recklessly. It also punishes repeat offenders more severely. Thus, the punishment for a violation of subparagraph 1030(a)(5)(A)(knowingly causing a transmission that intentionally causes damage) is - imprisonment for any term of years or for life and/or a fine of not more than $250,000 (not more than $500,000 for an organization), if the defendant knowingly or recklessly causes a death through the commission of the offense; - imprisonment for not more than 20 years and/or a fine of not more than $250,000 (not more than $500,000 for an organization), if the defendant knowingly or recklessly causes serious bodily injury through the commission of the offense; - imprisonment for not more than 20 years and/or a fine of not more than $250,000 (not more than $500,000 for an organization), if the defendant a prior conviction under subsections 1030(a) or (b); - imprisonment for not more than 10 years and/or a fine of not more than $250,000 (not more than $500,000 for an organization), if the offense causes a loss that over the course of a year exceeds $5,000; modifies, impairs, or could modify or impair medical services; causes physical injury; threatens public health or safety; affects a justice, national defense, or national security entity computer; or affects 10 or more protected computers over the course of a year. - imprisonment for not more than for not more than 1 year and/or a fine of not more than $100,000 (not more than $200,000 for an organization), for any other violation of the subparagraph. The punishment for a violation of subparagraph 1030(a)(5)(B)(intentional access that reckless causes damage) is - imprisonment for not more than 20 years and/or a fine of not more than $250,000 (not more than $500,000 for an organization), if the defendant a prior conviction under subsections 1030(a) or (b); - imprisonment for not more than 5 years and/or a fine of not more than $250,000 (not more than $500,000 for an organization), if the offense causes a loss that over the course of a year exceeds $5,000; modifies, impairs, or could modify or impair medical services; causes physical injury; threatens public health or safety; affects a justice, national defense, or national security entity computer; or affects 10 or more protected computers over the course of a year. - imprisonment for not more than for not more than 1 year and/or a fine of not more than $100,000 (not more than $200,000 for an organization), for any other violation of the subparagraph. The punishment for a violation of subparagraph 1030(a)(5)(C)(intentional access that causes damage and loss) is - imprisonment for not more than 10 years and/or a fine of not more than $250,000 (not more than $500,000 for an organization), if the defendant a prior conviction under subsections 1030(a) or (b); - imprisonment for not more than for not more than 1 year and/or a fine of not more than $100,000 (not more than $200,000 for an organization), for any other violation of the subparagraph. The section's legislative history provides some insight into why the damage thresholds are set as they are. In the case of damage in excess of $5,000, another earlier prohibition had spoken of intrusions that "cause[d] loss or damage to one or more other persons of value aggregating $1,000 or more during any 1-year period." The Senate committee report accompanying the 1996 amendments observed that use of the term "damage" contemplated the inclusion of all economic harm attributable to the intrusion and that the increased dollar limitation was expected to restrict federal felony prosecutions to the more serious cases: The 1994 amendment required both 'damage' and 'loss,' but it is not always clear what constitutes 'damage.' For example, intruders often alter existing log-on programs so that user passwords are copied to a file which the hackers can retrieve later. After retrieving the newly created password file, the intruder restores the altered log-on file to its original condition. Arguably, in such a situation, neither the computer nor its information is damaged. Nonetheless, this conduct allows the intruder to accumulate valid user passwords to the system, requires all system users to change their passwords, and requires the system administrator to devote resources to resecuring the system. Thus, although there is arguably no 'damage,' the victim does suffer 'loss.' If the loss to the victim meets the required monetary threshold, the conduct should be criminal, and the victim should be entitled to relief. The bill therefore defines 'damage' in new subsection 1030(e)(8), with a focus on the harm that the law seeks to prevent. As in the past, the term 'damage' will require ... significant financial losses. S.Rept. 104-357 at 11 (1996). Ordinarily, the presence of a separate hacker prohibition with less severe penalties would argue against allowing "damage assessment" and "security enhancement" costs to be used to reach the $5,000 threshold for the more severe penalty. The report language might be read to rebut such a presumption, but it might also be characterized as asserting no more than that the cost of new locks ("resecuring the system") can be considered damage when the keys ("passwords") are stolen. The USA PATRIOT Act reduced the prospect of misconception by supplying an explicit definition of "loss" as used here: "the term 'loss' means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service," 18 U.S.C. 1030(e)(11). Thus, the losses incurred by a contractor employed to manage the damaged computer system may properly be included to reach the $5,000 threshold. It also eliminated a second potential problem. The 1996 amendments, perhaps inadvertently, rephrased the aggregate $5,000 damage-loss threshold describing the victims as "individuals" rather than the term previously employed, "persons." The change stimulated contentions that Congress intended to limit the cases where the threshold could be reached entirely to the damages and losses suffered by human beings without any reference to the damages and losses suffered by corporate or other legal entities. The USA PATRIOT Act negated the problem by describing the damage-loss victims as "persons" and by defining persons to include individuals and any "legal or other entity." The long-standing medical tampering element has no monetary threshold and has remained essentially unchanged since it was added in response to an incident in which juvenile hackers broke into the computer system of the Memorial Sloan-Kettering Cancer Center. The inclusion of computer tampering that causes physical injuries or threatens public health or safety, on the other hand, is new with the 1996 amendments and is designed to reach more general threats: As the NII [National Information Infrastructure] and other network infrastructures continue to grow, computers will increasingly be used for access to critical services such as emergency response systems and air traffic control, and will be critical to other systems which we cannot yet anticipate. S.Rept. 104-357 at 11 (1996). The last entry is the work of the Identity Theft Enforcement and Restitution Act. Its Senate sponsor explained that it addressed the increasing number of cyber attacks on multiple computers, by making it a felony to employ spyware or keyloggers to damage 10 or more computers, regardless of the aggregate amount of damage caused. By making this crime a felony, the bill ensures that the most egregious identity thieves will not escape with minimal punishment under Federal cyber crime laws. 153 Cong. Rec. S14570 (daily ed. Nov. 15, 2008)(remarks of Sen. Leahy). Here as elsewhere, offenses committed by juveniles are more likely to result in state rather than federal proceedings. Many of the other auxiliary provisions of law such as those relating to the Sentencing Guidelines, forfeiture, and the like, which have little relevance in the case of simple trespassing, may have real consequences in the case of the damage offenses proscribed in paragraph 18 U.S.C. 1030(a)(5). The Sentencing Guidelines operate in paragraph 1030(a)(5) damage cases much as they do in paragraph 1030(a)(2) information acquisition cases. The offenses are assigned to the same guideline, U.S.S.G. §2B1.1. Some of that guideline's escalators, however, are more obviously relevant in damage cases. For example, there is a minimum enhancement of 4 levels when a paragraph 1030(a)(5) offense involves the intentional infliction of damage, and another range of enhancements when an offense has multiple victims. In addition, although the two offenses trigger the same range of enhancements based on the extent of loss or damage caused by the offense, the amount of damage or loss is often greater in a damage case. Property derived from, or facilitating the commission of, a violation of any paragraph of 18 U.S.C. 1030 is subject to confiscation. Restitution is mandatory when related to a violation of a paragraph which proscribes fraud or property damage. When confiscation was limited to the offender's ill-gotten gains, forfeiture in a damage case was uncommon. Confiscation may become more prevalent now that property used to inflict damage in violation of paragraph 1030(a)(5) is subject to forfeiture. Regardless of the criminal sanctions imposed, offenders of paragraph 1030(a)(5) may also incur civil liability for serious damage caused. Victims of a violation of paragraph 1030(a)(5) or any violation of subsection 1030(a) resulting in the requisite serious harm have a cause of action for damages and equitable relief if suit is brought within two years. Damages to medical records, or damage causing physical injury or endangering public safety, or damage of certain government computers may also subject the offender to "compensatory" damages beyond "economic" damages—a difference that may entitle a victim to pecuniary damages as well as damages for pain and suffering but probably not exemplary damages. When the victim's claim is based solely upon the fact that more than $5,000 worth of harm has been inflicted, recovery is limited to economic damages. A victim is described as "any person who suffers loss or damage by reason of a violation of this section," but initially there was no specific definition of the term "person" in either §1030 or in the definitions applicable to Title 18 generally. The legislative history offered no further edification and the courts had left the issue unaddressed. "Person" could have meant individuals, or individuals and other legal entities including governmental entities, or individuals and other legal entities but not including governmental entities. Credible arguments could have been advanced for each of the possible readings, but the fact that Congress elected to use the term "person" to mean only individuals in paragraph 1030(a)(7)(extortionate threats) might have seemed to favor a similar interpretation in subsection 1030(g). The USA PATRIOT Act resolved the question and answered several others. First, it supplied a definition of person—"the term 'person' means any individual, firm, corporation, educational institution, governmental entity, or legal or other entity." Then, it added an equally generous definition of the kinds of losses that might give rise to civil liability—"the term 'loss' means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service." Finally, it made clear that subsection 1030(g) does not create a cause of action for loss or damage attributable to "the negligent design or manufacture of computer hardware, computer software, or firmware," 18 U.S.C. 1030(g). Several consequences flow from designation of an offense as a federal crime of terrorism. Among the paragraph 1030(a) offenses only the paragraph (a)(1) espionage offenses and the paragraph (a)(5) serious damage offenses (not including those considered serious only because they involve damage in excess of $5,000) have been classified as federal crimes of terrorism. Designation as a federal crime of terrorism triggers the application of several other substantive and procedural criminal statutes, regardless of any further nexus to terrorism. Federal crimes of terrorism are subject to an 8-year statute of limitations rather than the 5-year period that governs most federal crimes. The maximum term of supervised release for a federal crime of terrorism is life, rather than the 5-year maximum that applies in most other instances. An individual charged with a federal crime of terrorism is presumed to be an inappropriate subject for release on bail prior to his criminal trial. The maximum term of imprisonment for aggravated identity theft is 5 years when the offense is committed in relation to a federal crime of terrorism rather than the 2-year maximum that would otherwise apply. It is a separate federal crime punishable by imprisonment for any term of years or for life to knowingly provide maritime transportation to an individual intending to commit, or in flight from the commission of, a federal crime of terrorism. Federal crimes of terrorism are also by definition RICO predicate offenses. Among other things, RICO outlaws the patterned commission of predicate offenses ("racketeering activities") in order to acquire or conduct the affairs of an enterprise whose activities affect interstate or foreign commerce. Offenders face imprisonment for up to 20 years, as well as the prospect of civil liability. Any RICO predicate offense is in turn a money laundering predicate offense under 18 U.S.C. 1956, which among other things outlaws laundering the proceeds of a predicate offense or plowing them back into further predicate offenses. The same general observations concerning attempt, conspiracy, and aiding and abetting noted for the simple trespass paragraph apply here. It is a separate crime to attempt or conspire to violate paragraph 1030(a)(5) or any of the other paragraphs of subsection 1030(a). Those who attempt or conspire to violate, or who aid and abet the violation of another, are subject to the same penalties as those who commit the substantive offense. There are more than a few other federal statutes that might be implicated by damage or destruction of federal property, of the property of financial institutions, or of property used in interstate or foreign commerce. The principal uncertainty is whether these general statutes can be applied to protect intangible property, like information in computer storage. Even if computer-stored data is considered tangible property (electronic files rather than paper files), several statutes that outlaw damage or destruction may be unavailable because they either call for a specific means of destruction (destruction by fire or explosives) or because they protect a particular kind of property (timber or buildings). Destruction of Government Records. Section 2071 makes it a federal crime for anyone to unlawfully "conceal, remove, mutilate, obliterate, or destroy ... any record, proceeding, map, book, paper, document, or other thing, filed or deposited with ... any judicial or public officer of the United States." The damage or destruction of government, computer-stored records will fall within the coverage of §2071 only if it can meet each of the action (obliterate or destroy), object (any record or other thing) and place (filed with a federal judicial or public officer) tests. The phrase "conceal, remove, mutilate, obliterate, or destroy" may lend itself to the argument that it extends to destruction or complete inaccessibility, but perhaps not to less than totally destructive damage, of computerized records. Electronic destruction seems to fit under either "obliterate" ("to make undecipherable by obscuring") or "destroy." Absent obliteration or destruction, the section may be thought to protect only tangibles, since the word "mutilate" has obvious physical connotations. Yet one court among the few to construe §2071 held that it did not prohibit photocopying of government records—not because that would constitute the removal of an intangible (information), but because the statute was designed to prevent "any conduct which deprives the Government of the use of its documents." The phrase "any record, proceeding, map, book, paper, document, or other thing, filed or deposited with" would seem to cover any "thing" capable of being "filed or deposited." In these days of "electronic filing" any contention that federal computer records do not fit the phrase seems untenable. The final requirement might appear to protect only those records based on deposits with federal court or administrative officials, but the scant case law available suggests coverage extends to any record maintained by the government. Violations of §2071 are punishable by imprisonment for not more than three years and/or a fine of not more than $250,000, or both fine and imprisonment. Destruction of Federal Property. Section 1361 makes it a federal crime to "willfully injure or commit any depredation against any property of the United States...." Although an offender must be shown to have to injured or depredated the property, the government need not show that the defendant knew the property belonged to the government. The federal courts have permitted prosecution under §1361 of a defendant who used a hammer and drill to destroy a federal computer. There does not appear to be any reported cases in which §1361 was used to prosecute electronic computer abuse for damaging federal property, and federal authorities used an earlier version of the computer abuse statute, 18 U.S.C. 1030, to prosecute one of the first cases of electronic computer abuse resulting in damage. Damage or destruction of federal property is punishable by imprisonment for not more than 10 years and/or a fine of not more than $250,000 (or not more than one year and/or a fine of not more than $100,000 if the damage causes amounts to $1,000 or less and no one dies as a result of the offense). Destruction of Federal Communications Systems. Willful or malicious interference or disruption "in any way" with any communications system owned by the United States or used by the United States for military or civil defense purposes contravenes §1362 and is punishable by imprisonment for not more than 10 years and/or a fine of not more than $250,000. The language of §1362 leaves little room for any contention that it does not apply to computer abuse aimed at federal communications facilities. A handful of federal statutes protect financial institutions from theft in one form or another, but not property damage or destruction. Section 1030 appears to be the only statute that includes a specific provision designed to protect the property of financial institutions from damage or destruction. Transportation. The federal statutes, other than paragraph 1030(a)(5), most likely to cover the computerized damage or destruction to property in interstate commerce, involve transportation. Each of the provisions that proscribe interference with air, motor, rail and sea transportation appear to have been drafted with sufficient breadth to reach damage or destruction of at least some of the computer systems incidental to those transportation facilities. For example, the provisions applicable to the destruction of aircraft and aircraft facilities penalize anyone who "damages, destroys, or disables any air navigation facility ... if such ... damaging, destroying, [or] disabling ... is likely to endanger the safety of any such aircraft." This would presumably protect air traffic control systems, but not computerized passenger information, that is, gridlock is not proscribed unless it "endanger[s] the safety" of air travel. The language of the provisions outlawing interference with maritime navigation is strikingly comparable: "a person who unlawfully and intentionally ... destroys or seriously damages maritime navigational facilities or seriously interferes with their operation, if such act is likely to endanger the safe navigation of a ship" or attempts or conspires to do so is punishable by imprisonment for not more than 20 years and/or a fine of not more than $250,000, or if death results from commission of the offense, by imprisonment for life or death. Federal jurisdiction for prosecution exists if the offense occurs within American territorial waters, if the vessel or vessels engaged are of American registry, or if committed by an American or by someone later found in this country. Similarly, attacks on mass transit are punishable by imprisonment for not more than 20 years and/or a fine of not more than $250,000 (not more than $500,000 for organizations), and if death results from commission of the offense, by imprisonment for life or death. Once again, computer abuse that targets rail traffic control is almost certainly covered; computer abuse that targets ticket control is almost certainly not. The language of the federal law outlawing the destruction of motor vehicle facilities seems only slightly more modest, for it extends to anyone who "with a reckless disregard for the safety of human life," willfully "damages, destroys ... tampers with," or otherwise makes "unworkable, unusable, or hazardous to work or use" any "facility used in the operation of, or in support of the operation of, motor vehicles engaged in interstate or foreign commerce," 18 U.S.C. 33(a). Computer abuse that damages or destroys motor traffic control systems in a manner threatening to human safety would seem to fall within the reach of Section 33. Other Damage Crimes. Other federal crimes that might be implicated by damaging computer systems used in interstate or foreign commerce include those that cover damage to an energy facility or proscribe interference with the operation of a communications or weather satellite. Most of the states also outlaw damaging computer equipment, software, or systems. Those paragraph 1030(a)(5) damage offenses that qualify as federal crimes of terrorism—damaging a protected computer and thereby impairing medical care, causing physical injury, or threatening public health or safety; or damaging a governmental justice, national defense, or national security computer system—are by virtue of that fact RICO predicate offenses. Among other things, RICO outlaws conducting the business of a commercial enterprise through the patterned commission of predicate offenses. Violations are punishable by (a) forfeiture of any property acquired through a RICO violation and of any property interest in the enterprise involved in the violation, and (b) imprisonment for not more than 20 years, or life if one of the predicate offenses carries such a penalty, and/or a fine of not more than $250,000 (not more than $500,000 for organizations). RICO violations also subject the offender to civil liability. The courts may award anyone injured by a RICO violation treble damages, costs and attorneys' fees, and may enjoin RICO violations, order divestiture, dissolution or reorganization, or restrict an offender's future professional or investment activities. The principal federal money laundering statutes, 18 U.S.C. 1956 and 1957, outlaw various financial activities that involve the proceeds from other federal crimes. They prohibit domestic laundering of the proceeds of these predicate offenses, referred to as "specified unlawful activities"; international laundering of the proceeds of predicate offenses; using the proceeds of predicate offenses to promote further predicate offenses; or spending or depositing more than $10,000 of the proceeds of predicate offenses. Offenses under the various paragraphs of 18 U.S.C. 1030 are all money laundering predicate offenses, although paragraph 1030(a)(5) computer damage offenses are less likely to generate proceeds than are the fraud and espionage offenses of paragraphs 1030(a)(4) and 1030(a)(1). (a) Whoever ... (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period ... shall be punished as provided in subsection (c) of this section. (b) Whoever attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section. Paragraph 1030(a)(4) outlaws fraud by computer intrusion. Its elements consist of knowingly and with intent to defraud; accessing a protected computer without authorization, or exceeding authorization; thereby furthering a fraud and obtaining anything of value (other than a minimal amount of computer time, i.e., more than $5,000 over the course of a year). Paragraph 1030(a)(4) outlaws fraud against "protected computers," that is, computers used in or affecting interstate or foreign commerce, those used by or for "the United States Government," or those used by or for a financial institution. The committee reports indicate that Congress understood the phrase in the original legislation, "used in interstate or foreign commerce," to be the equivalent of "affecting interstate or foreign commerce." When the Identity Theft Enforcement and Restitution Act recast the jurisdictional base to expressly include computers "affecting" interstate or foreign commerce, it seemed to reinforce the committee's expansive understanding. Congress further amended the definition of protected computer by adding the phrase "including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce." In doing so, it might be thought to have intended to preclude overseas application of the paragraphs of subsection 1030(a) under any other circumstances, for example, a federal computer located outside the United States that is not used in a manner that affects commerce. As noted earlier, there may be some real doubt whether the phrase "United States Government" computers includes computers of the legislative and judicial branches or of the independent federal agencies, or whether it encompasses only those within the executive branch. The definition of protected computer in subparagraph 1030(e)(2)(B)(one used "in or affecting interstate or foreign commerce or communication") to which several of the section's offenses are anchored clearly anticipates expansive coverage. On the other hand, in paragraph 1030(a)(3), Congress uses the phrase "Government of the United States" interchangeably with the more expansive phrase "department or agency of the United States." Failure to follow suit in paragraph (a)(4) might be considered more than inadvertent. Again, to date, the courts have been unable to agree on the meaning of "without authorization" or "exceeds authorized access" as used in paragraph 1030(a)(4) and the other paragraphs of 18 U.S.C. 1030, even though the statute supplies a specific definition of the term "exceeds authorized access." Some have applied the terms to access by authorized employees who use their access in any unauthorized manner or for unauthorized purposes and to outsiders who have been granted access subject to explicit reservations. Others have concluded that "a person who 'intentionally accesses a computer without authorization' §§1030(a)(2) and (4), accesses a computer without any permission at all, while a person who 'exceeds authorized access,' id. , has permission to access the computer, but accesses information on the computer that the person is not entitled to access." Paragraph 1030(a)(4) was proposed as part of the original statute in 1984, but only enacted with the 1986 amendments. The reports accompanying the 1986 amendments note that the intent element—"knowingly and with intent to defraud"—"is the same standard used for 18 U.S.C. 1029 relating to credit card fraud." The phrase as used in the credit card fraud statute means that the offender is conscious of the natural consequences of his action (i.e., that it is likely that someone will be defrauded) and intends that those consequences should occur (i.e., he intends that someone should be defrauded). The phrase "thereby furthers a fraud" insures that prosecutions are limited to cases where use of a computer is central to a criminal scheme rather those where a computer is used simply as a record-keeping convenience. Similarly, the demand that the value of converted property exceed $5,000 minimizes the possibility that mere computer trespassing will be prosecuted as fraud. The case law confirms the difficulty of maintaining a prosecution against even a repeated trespasser under paragraph 1030(a)(4), as United States v. Czubinski demonstrates. Czubinski involved an Internal Revenue Service employee who conducted a number of unauthorized searches of taxpayer files in an IRS computer system. The Court of Appeals overturned his conviction on four counts of violating paragraph 1030(a)(4) because it felt the government had failed to prove that the government had been defrauded, that is, deprived of anything of value. Violations are punishable by imprisonment for not more than five years (not more than 10 years for subsequent offenses) and/or a fine of not more than $250,000 (not more than $500,000 for organizations). The same sentencing guideline covers both fraud under paragraph 1030(a)(4), and damage under paragraph 1030(a)(5), although the escalators based on the amount of loss inflicted are likely to be more telling in the case of wide-spread damage caused by the release of a worm or virus. The attempt, conspiracy, and complicity provisions apply to paragraph 1030(a)(4) offenses in much the same way as those provisions apply to the other paragraphs of the section. Conviction of a paragraph 1030(a)(4) offense requires a victim restitution order and may lead to the confiscation of the fruits and instrumentalities of the offense. Victims may sue for compensatory damages and/or injunctive relief under subsection 1030(g). Paragraph 1030(a)(4) prohibits unauthorized use of a government computer, a bank computer or a computer used in interstate or foreign commerce as an integral part of a fraud. Its companions at federal criminal law include general criminal statutes, statutes proscribing theft or fraud of federal property, those that outlaw the theft or fraud of the property of financial institutions, and those that prohibit theft or fraud involving property with an interstate or foreign commerce nexus. Wire Fraud. Although the wire fraud statute, 18 U.S.C. 1343, does not refer to "things of value," a phrase that encompasses both the tangible and the intangible, neither does it refer exclusively to physical items such as "goods, wares, merchandises, securities or money." Rather it condemns the use of interstate or foreign wire communications pursuant to a scheme to defraud another of "money or property." The Supreme Court has made it clear that "property" within its purview may include confidential information, and various federal courts have made it clear that confidential information in computer storage is no less favored. In fact, at one point a commentator claimed that "[t]he wire fraud statute, 18 U.S.C. 1343, has produced more convictions for computer-related crimes than §1030 or any other computer-specific statute." Credit Card Fraud. Section 1029 of Title 18 (credit card fraud) and Section 1030 (computer fraud) share a common history. Like §1030, §1029 underwent rather regular fine-tuning after its initial passage in 1984 as part of the Comprehensive Crime Control Act of that year. Unlike §1030, it has a single, uniformly applicable jurisdictional base: it applies to offenses that "affect interstate or foreign commerce." The two overlap where §1029 outlaws the deception of commercial computer systems through the improper use of an "access device" to acquire cash, credit, merchandise, or services. An access device is (1) any card, personal identification number, plate, electronic serial number, code, mobile identification number, or any account number or other telecommunications service, equipment, or instrument identifier, or other means of account access; (2) that either (a) can be used, alone or in conjunction with another access device, to obtain money, goods, services, or any other thing of value, or (b) can be used to initiate a transfer of funds (other than a transfer originated solely by paper instrument). The level of intent for each of the several crimes established in §1029 is the same as that often used for §1030—"knowing and with the intent to defraud." Thus, criminal liability under §1029 requires that the offender know that his or her actions are likely to deprive another of something of value and demands that the offender means for that deprivation to occur. Section 1029 establishes three types of crimes: misuse of access devices, conduct in anticipation of misuse of access devices, and attempts or conspiracies to commit one of these substantive violations. The misuse crimes include use of a counterfeit access device; a "counterfeit access device" is one that is "counterfeit, fictitious, altered, or forged, or an identifiable component of an access device or a counterfeit access device"; use of an unauthorized access device resulting in a loss or gain over the course of one year worth than $1,000; an "unauthorized access device" is one that has been "lost, stolen, expired, revoked, canceled, or obtained with intent to defraud"; and use of an access device "issued to another person" resulting in a loss or gain over the course of one year worth $1,000 or more; again each of the uses is only criminal if done knowingly and with an intent to defraud. The "preparation" offenses of §1029 each extend only to misconduct that affects interstate or foreign commerce and only to misconduct committed knowingly and with an intent to defraud. They include possession of 15 or more counterfeit or unauthorized access devices; possession of "device-making" equipment (§1029(a)(4); essentially counterfeiting paraphernalia; offering another an access device or offering to sell information concerning an access device, without the authorization of the issuer of the device; use of a telecommunications device modified or altered to permit the unauthorized receipt of telecommunications services; use of a scanner; that is, illegal wiretapping or electronic eavesdropping equipment; possession of computer equipment used to avoid telecommunications charges, that is, possession of "hardware or software used for altering or modifying telecommunications instruments to obtain unauthorized access to telecommunications services"; and causing another to present credit card slips for payment with the intent to defraud. Paragraph 1029(b)(1) makes it a separate offense to attempt to commit any of the substantive crimes in subsection 1029(a) just described. Paragraph 1029(b)(2) makes it a separate offense to conspire to commit any of them. Attempt carries the same penalties as the completed offense (imprisonment either for not more than 10 or not more than 15 years), but conspiracy is punishable by imprisonment for not more than half the maximum terms applicable to the underlying offense (imprisonment for not more than 5 or not more than 7.5 years). One reason for the distinction may be that while attempt is merged in the completed offense so that an offender may be punished for either but not both, the crime of conspiracy is ordinarily not merged in the substantive offense so that punishment for either or both is permitted. In any event, the maximum penalties are determined by those set for the underlying violations of §1029: (1) imprisonment for not more than 10 years for first time offenses involving use of counterfeit access devices; use of unauthorized access devices; possession of 15 or more counterfeit or unauthorized access devices; unauthorized sale of an access device; possession of a device designed to avoid telephone charges; or fraudulently causing another to present credit card slips for payment; and (2) imprisonment for not more than 15 years for first time offenses involving possession of counterfeiting equipment; use of another's access device to defraud; possession of a scanner; or possession of equipment designed to avoid communications service charges. Conspiracy. The same statute that makes it a crime to conspire to violate federal law also makes it a federal crime to conspire to defraud the United States. Unlike the mail and wire fraud statutes, a successful prosecution for conspiracy to defraud the United States does not require a showing that the defendant sought to deprive the United States or anyone else of money or property. This lesser known branch of the statute has extraordinary range and "reaches any conspiracy for the purpose of impairing, obstructing or defeating the lawful function of any department of the Government." There need be no evidence of any other underlying substantive offense or purpose. "The government need only show (1) that the defendant entered into an agreement (2) to obstruct a lawful function of the government (3) by deceitful or dishonest means and (4) at least one overt act in furtherance of the conspiracy." Fraud Involving Government Computers. There are also a host of federal criminal statutes that proscribe fraud in one form or other, more than a few of which would cover the unauthorized manipulation of federal computers as an integral part of a scheme to defraud. Two of the more prominent, the false statement statute, 18 U.S.C. 1001 (false statements on a matter within the jurisdiction of a federal agency or department) and conspiracy to defraud the United States, 18 U.S.C. 371, have already been mentioned. Others include 18 U.S.C. 1031 (major procurement fraud against the United States); 18 U.S.C. 1035 (false statements relating to health care); 18 U.S.C. 1014 (false statements on federally insured loan and credit applications); 18 U.S.C. 1010, 1012 (false statements concerning various HUD transactions); and 18 U.S.C. 287 (false claims against the United States). Although less numerous, several federal criminal statutes outlaw defrauding financial institutions in language similar to the prohibitions against defrauding the United States, most notably the general bank fraud provision, 18 U.S.C. 1344 and the laws that proscribe embezzlement and similar misconduct by bank officers and employees. CAN-SPAM Act. The most likely overlap may be with the CAN-SPAM Act of 2003, 18 U.S.C. 1037. The CAN-SPAM Act offers protection to all "protected computers." The criminal provisions of the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM) generally broaden the type of coverage provided by the 1030 paragraphs and add to the federal government's ability to prosecute hackers who use e-mail for fraudulent purposes. More precisely, §1037 proscribes, when done knowingly and in a manner in or affecting interstate or foreign commerce, accessing a protected computer and intentionally sending multiple e-mails (multiple means more than 100 a day, 1,000 a month, or 10,000 a year); using a protected computer to send commercial e-mails with the intent to deceive or mislead as to their source; materially altering an e-mail header and sending out multiple e-mails under the falsified header; registering for 5 or more e-mail accounts or 2 or domain names providing false identification and using them to send out multiple commercial e-mails; or providing false identification to registrant of 5 or more IP addresses and using the addresses to send out multiple commercial e-mails, or conspires to do so. Offenders face one of a number of sentences ranging from imprisonment for not more than a year to imprisonment for not more than 5 years depending on the extent and regularity of the offense, among other factors. When the offense is punishable by imprisonment for not more than a year, offenders also face to a fine of not more than $100,000 (not more than $200,000 for organizations); those guilty of other violations of Section 1037 face fines of not more than $250,000 (not more than $500,000 for organizations). Any property used in, or realized through, the commission of the offense is subject to confiscation. Money Laundering. The principal federal money laundering statutes, 18 U.S.C. 1956 and 1957, outlaw various financial activities that involve the proceeds from other federal crimes. They prohibit domestic laundering the proceeds of these predicate offenses, referred to as "specified unlawful activities"; international laundering the proceeds of predicate offenses; using the proceeds of predicate offenses to promote further predicate offenses; or spending or depositing more than $10,000 of the proceeds of predicate offenses. Offenses under the various paragraphs of 18 U.S.C. 1030 are all money laundering predicate offenses. Directly or indirectly they will support a money laundering prosecution as will several of the crimes that may be implicated whenever a paragraph 1030(a)(4) fraud offense is involved: that is, credit card fraud (18 U.S.C. 1029), and wire fraud (18 U.S.C. 1343). Financial transactions are defined broadly for money laundering purposes to encompass virtually every possible transfer of wealth, as long as they "in any way or degree affect[] interstate or foreign commerce ... or ... involving the use of a financial institution which is engaged in, or the activities of which affect, interstate or foreign commerce in any way or degree." The proof required to satisfy this "any way or degree" jurisdictional element, has been characterized as "de minimis," "minimal," "slight," or "incidental," even after the Supreme Court pointed out that Congress's legislative authority under the commerce clause is not boundless. To establish "promotion" the government needs show little more than that the transaction is intended to further the illicit scheme, activity, or business. To convict an accused of violating §1957, government must establish that "(1) [the defendant] engaged in or attempted to engage in a monetary transaction; (2) in criminally derived proeprty worth at least $10,000; (3) with knowledge that the property was derived from unlawful activityu; and (4) the prjoperty was, in fact, derived from specified unlawful activity." The predicate offenses ("specified unlawful activities") are the same as those for §1956, the meaning of "monetary transaction" closely tracks that of a "financial transaction" in §1956, and the definition of monetary transaction includes the jurisdiction component of the offense, that is, that the transaction occurs "in or affecting interstate or foreign commerce," which requires no more than the de minimis nexus demanded of §1956. State Computer Fraud Law. Although the elements vary considerably, most states have explicit statutory prohibitions against computer fraud. (a) Whoever ... (7) with intent to extort from any person any money or other thing of value, transmits in interstate or foreign commerce any communication containing any (A) threat to cause damage to a protected compute r; (B) threat to obtain information from a protected computer without authorization or in excess of authorization or to impair the confidentiality of information obtained from a protected computer without authorization or by exceeding authorized access; or (C) demand or request for money or other thing of value in relation to damage to a protected computer, where such damage was caused to facilitate the extortion; shall be punished as provided in subsection (c) of this section. (b) Whoever attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section. Congress enacted subparagraph 1030(a)(7)(A) in 1996 out of concern that "the 'property' protected under existing laws, such as the Hobbs Act, 18 U.S.C. 1951 (interference with commerce by extortion), or 18 U.S.C. 875(d)(interstate communication of threat to injury property of another), does not clearly include the operation of a computer, the data or programs stored in a computer or its peripheral equipment, or the decoding keys to encrypted data." It enacted subparagraphs 1030(a)(7)(B) and (C) in 2008 following the recommendation of the Department of Justice to "cover the situation in which a criminal has already stolen the information and threatens to disclose it unless paid off" and in which "other criminals cause damage first—such as by accessing a corporate computer without authority and encrypting critical data—and then threaten that they will not correct the problem unless the victim pays." Paragraph 1030(a)(7) stands on dual jurisdictional footings. First, a successful prosecution is only possible if a threat or demand has been transmitted in interstate or foreign commerce, an element that may be satisfied even in the case of intrastate communications under some circumstances. Second, conviction can only be had if the transmitted threat is directed against a protected computer, that is, one used in or affecting interstate or foreign commerce, one used by or for the federal government, or one used by or for a financial institution. Prior to the 2001 amendment to the definition of "protected computer," a paragraph 1030(a)(7) extortion proscription was said to apply to an extortionate threat initiated overseas but directed at a computer within this country. Then in 2001, Congress noted that the class of computers, protected because of their use in interstate or foreign commerce, should be understood to "include a computer located outside the United States that is used in a manner than affects interstate or foreign commerce or communication of the United States." The question arises whether by specifying this particular form of overseas application Congress intended to exclude all others left unmentioned. Subparagraph 1030(a)(7)(A) proscribes threats to cause computer "damage" and the legislative history describes its reach in terms consistent with the common understanding of the word "damage": New [s]ection 1030(a)(7) would close [the] gap in the law and provide penalties for the interstate or international transmission of threats directed against computers and computer systems. This covers any interstate or international transmission of threats against computers, computer networks, and their data and programs whether the threat is received by mail, a telephone call, electronic mail, or through a computerized messaging service. Unlawful threats could include interference in any way with the normal operation of the computer or system in question , such as denying access to authorized users, erasing or corrupting data or programs, slowing down the operation of the computer or system, or encrypting data and then demanding money for the key. The USA PATRIOT Act expanded the damage definition and thus the coverage of the paragraph by reducing the definition to "any impairment to the integrity or availability of data, a program, a system, or information." Construction of other threat statutes may provide useful insight into what constitutes a "threat" for purposes of subparagraph 1030(a)(7)(A). Although statements of political hyperbole may not always constitute true threats, a threat is no less a threat because it is contingent, because the speaker does not intend or is unable to carry it out, because the threat was not directly communicated to the target, or because the language used might be considered cryptic or ambiguous. Whether a particular communication constitutes a threat is a question determined by whether a reasonable person, considering all the circumstances, would regard the communication as a threat. While the jurisdictional element, such as transmission in interstate commerce, must be established, the government need not show the defendant knew that the threat had been transmitted in interstate commerce. Subparagraphs 1030(a)(7)(B) and (C) differ from the usual threats. Subparagraph (B) addresses not threats to damage a computer or its data, but threats to breach the confidentiality of that data. Subparagraph (C) addresses not threats of future damage, but threats to fail to undo damage already inflicted if extortionate demands are not met. The level of intent required for a violation of paragraph 1030(a)(7) differs from the level used for the fraud provisions of §1030. Rather than demand that the offense be committed "knowingly and with an intent to defraud," each of the offenses under paragraph 1030(a)(7) must be committed "with the intent to extort." Because the crimes are only complete if committed with this intent to extort, the paragraph anticipates that the offender will have intended his victim to feel threatened. It thereby avoids some of the uncertainty that has plagued the threat statutes. Violations are punishable by imprisonment for not more than five years (not more than 10 years for second and subsequent offenses) and/or a fine of not more than $250,000 (not more than $500,000 for organizations). In cases involving more than $5,000 damage or some other qualifying circumstance, victims may claim the advantages of the civil cause of action for damages available under subsection 1030(g). The general fraud/damage sentencing guideline, U.S.S.G. §2B1.1, applies to violations of paragraph 1030(a)(7). Property derived from, or used to facilitate, an extortion offense under paragraph 1030(a)(7) is subject to confiscation. Offenders may also be ordered to pay restitution. Offenses under the paragraph are not considered federal crimes of terrorism, however. The same general observations concerning attempt, conspiracy, and aiding and abetting noted with respect to the other paragraphs of 1030(a) apply here. It is a separate crime to attempt or conspire to violate paragraph 1030(a)(7). Those who attempt or aid and abet the violation of another are subject to the same penalties as those who commit the substantive offense. The same is true of conspiracies except that conspiracy prosecuted under the general conspiracy statute carries a five year maximum of imprisonment. Circumstances determine whether conduct which violates paragraph 1030(a)(7) might be prosecuted under the Hobbs Act. The Hobbs Act, 18 U.S.C. 1951, prohibits extortion that affects commerce. More precisely, among other things, it declares that "Whoever in any way or degree obstructs, delays, or affects commerce or the movement of any article or commodity in commerce, by ... extortion or attempts or conspires so to do ... shall be fined under this title or imprisoned not more than twenty years, or both." The government need show only a minimal impact on interstate or foreign commerce to satisfy the jurisdictional element of the Hobbs Act. For Hobbs Act purposes, "'extortion' means the obtaining of property from another, with his consent, induced by wrongful use of actual or threatened force, violence, or fear." "Under the fear of economic harm theory, a private citizen can commit extortion by leading the victim to believe that the perpetrator can exercise his or her power to the victim's economic detriment." Facially, paragraph 1030(a)(7) might seem little more than a more specific version of the Hobbs Act: the Hobbs Act prohibits the extortionate acquisition of property, generally, in a manner that affects interstate or foreign commerce; while paragraph 1030(a)(7) prohibits extortionate acquisition of property, specifically acquired by a threat to damage computer systems or data, in a manner that affects interstate or foreign commerce. Several federal statutes prohibit threats against "property" made with extortionate intent. The statutes in question include at a minimum 18 U.S.C. 875 (threats transmitted in interstate commerce), 18 U.S.C. 876 (mailing threatening communications), 18 U.S.C. 877 (mailing threatening communications from a foreign country), and 18 U.S.C. 880 (receipt of the proceeds of extortion). Other than the receipt statute, they are essentially alike, jurisdictional elements aside. Each prohibits the communication of a threat to injure the property of the addressee or of another conveyed with extortionate intent. Each identifies "money or other thing of value" as the extortionist's objective, and each punishes offenders by imprisonment for not more than two years and/or a fine of not more than $250,000. As noted earlier, the courts see extraordinary elasticity in the term "thing of value" when used in federal criminal law, but not infrequently are divided over which intangibles may legitimately be considered "property" for purposes of federal criminal statutes. In the context of mail and wire fraud, for instance, the Supreme Court held that an earlier version of those statutes did not reach schemes to defraud another of intangibles in the form of the honest services of public officials, ( McNally ) nor a scheme to fraudulently acquire a state-issued license ( Cleveland ), but did reach schemes to defraud another of confidential information ( Carpenter ). Again, even in the case of the more narrowly construed statutes, however, the data and other intangibles at issue in computer cases would seem to more clearly resemble the Carpenter "confidential information" property than the McNally "honest public services" or the Cleveland "unissued license" property. Section 1030 is a money laundering predicate offense. Thus, financial transactions involving the proceeds from computer-related extortion that violate paragraph 1030(a)(7) may support a prosecution under 18 U.S.C. 1956 or 1957. Moreover, a violation of paragraph 1030(a)(7) may at the same time offend one of its companions that is a RICO predicate, for example, the Hobbs Act, 18 U.S.C. 875 (extortion affecting in interstate or foreign commerce), or the Travel Act (extortion is a Travel Act predicate), thereby raising the prospect of a RICO prosecution. (a) Whoever ... (6) knowingly and with intent to defraud traffics (as defined in [s]ection 1029) in any password or similar information through which a computer may be accessed without authorization, if — (A) such trafficking affects interstate or foreign commerce; or (B) such computer is used by or for the Government of the United States ... shall be punished as provided in subsection (c) of this section. (b) Whoever attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section. Paragraph 1030(a)(6) outlaws misconduct similar to the access device proscriptions of 18 U.S.C. 1029. It was enacted to deal with the practice of hackers posting the passwords for various computer systems on electronic bulletin boards. Although limited, it provides several distinct advantages. First, it covers passwords for government computers more clearly than does §1029. Second, as something of a lesser included offense to §1029, it affords the government plea bargaining room in a case that it might otherwise be forced to bring under §1029 or abandon. Third, it contributes a means of cutting off the practice of publicly posting access to confidential computer systems without imposing severe penalties unless the misconduct persists. Fourth, it supplies a basis for private enforcement through the civil liability provisions of subsection 1030(g) for misconduct that may be more appropriately addressed by the courts as a private wrong. Nevertheless, the paragraph has apparently been invoked only infrequently. The elements of the crime are knowingly and with an intent to defraud; trafficking in (i.e., "to transfer, or otherwise dispose of, to another, or obtain control of with intent to transfer or dispose of" (18 U.S.C. 1029(e)(5))); a computer password or similar computer key; and either - of a federal computer or - in a manner that affects interstate or foreign commerce. Federal jurisdiction exists where the traffic affects interstate or foreign commerce, or where the password or key is to a computer used by or for the Government of the United States. As has been said of other paragraphs and government computers, it is unclear whether the protection of paragraph 1030(a)(6) cloaks legislative and judicial branch computers or is limited to those of the executive branch. The uncertainty is born of the section's care to define the phrase "department or agency of the United States" to include all three branches and its use of that phrase in establishing some crimes, contrasted with its failure to use that phrase in paragraph 1030(a)(6), discussed supra . The explicit reference to overseas application of offenses affecting commerce under subparagraph 1030(e)(2), without a similar statement concerning government computers, may raise further uncertainty. Was the omission an oversight or intended to signal a limitation? The intent element is the same as that used in paragraph 1030(a)(4)(fraud), and in the credit card fraud proscriptions of 18 U.S.C. 1029: knowingly and with the intent to defraud. The phrase as used in the credit card fraud statute means that the offender is conscious of the natural consequences of his action (i.e., that it is likely that someone will be defrauded) and intends that those consequences should occur (i.e., he intends that someone should be defrauded). The first offense is punishable by imprisonment for not more than one year and/or a fine of not more than $100,000 (not more $200,000 for organizations); subsequent offenses are punishable by imprisonment for not more than 10 years and/or a fine of not more than $250,000 (not more than $500,000 for organizations). The general theft/damage sentencing guideline, U.S.S.G. §2B1.1, covers violations of paragraph 1030(a)(6) (traffic in passwords) as it does fraud and damage under paragraphs 1030(a)(4) and 1030(a)(5). Proceeds and property traceable to the proceeds of a violation of paragraph 1030(a)(6) trafficking offenses are subject to confiscation. Upon conviction, defendants are ordered to pay restitution. And, offenders may also be subject to a cause of action for damages or injunctive relief. Victims, who sue on grounds that the offense caused more than $5,000 in losses, may include lost revenues as well as the cost of damage assessment and of corrective and preventive measures. The generally applicable provisions dealing with attempt, conspiracy and complicity will apply with equal force in cases involving paragraph 1030(a)(6). Paragraph 1030(a)(6) appears to have few counterparts in federal law, other than the prohibition against trafficking in access devices (credit card fraud) under 18 U.S.C. 1029(a)(2) and the wire fraud provisions of 18 U.S.C. 1343. Section 1030 offenses, including offenses under paragraph 1030(a)(6) are money laundering predicate offenses. Paragraph 1030(a)(6), however, is not a RICO predicate offense. Nevertheless, conduct in violation of paragraph 1030(a)(6) may trigger a RICO prosecution, (1) if the proceeds of the offense are laundered in violation of the money laundering provisions, or (2) if the conduct in violation of paragraph 1030(a)(6) also constitutes a violation of the access device provisions of §1029 or wire fraud or both. Brokering computer passwords without more may not be the ground upon which a sprawling criminal enterprise might be built, but violations of paragraph 1030(a)(6), with other crimes, might be part of a pattern of criminal activity used to operate such an enterprise. (a) Whoever ... (1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information that has been determined by the United States Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations, or any restricted data, as defined in paragraph y of [s]ection 1 1 of the Atomic Energy Act of 1954, with reason to believe that such information so obtained could be used to the injury of the United States, or to the advantage of any foreign nation willfully communicates, delivers, transmits, or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it ... shall be punished as provided in subsection (c) of this section. (b) Whoever attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section. Paragraph 1030(a)(1) essentially tracks existing federal espionage laws—18 U.S.C. 793, 794, and 798—that ban disclosure of information potentially detrimental to U.S. national defense and well being, or more simply, laws that outlaw spying. The paragraph was enacted as part of the original act and has been amended primarily to more closely track other espionage laws. The distinctive feature of paragraph 1030(a)(1) is its merger of elements of espionage and computer abuse. Broken down into a simplified version of its constituent elements it bars anyone from either - willfully disclosing, - willfully attempting to disclose, or - willfully failing to return classified information concerning national defense, foreign relations, or atomic energy with reason to believe that the information either - could be used to injure the United States, or - could be used to the advantage of a foreign nation when the information was acquired by unauthorized computer access. The federal government is a creature of the Constitution. It enjoys only those powers that the Constitution grants it. Since the states are primarily responsible for the enactment and enforcement of criminal law, the validity of any federal criminal law depends upon a clear nexus to some power that the Constitution vests in the national government. Most of subsection 1030(a) represents the exercise of Congress's authority to enact laws for the regulation of interstate and foreign commerce, for example. Paragraph 1030(a)(1), on the other hand, is anchored in the protection of the defense and foreign relations of the nation, and so jurisdictional ties to interstate or foreign commerce are unnecessary. The state of mind element for a breach of paragraph 1030(a)(1) is pegged higher than the other subsection 1030(a) offenses. The offender must (1) purposefully transmit or retain information that (2) he has reason to believe could be used to the injure the United States or benefit another country, and (3) that he has obtained through access to a computer that he knows he had no authority to access. Violations are punishable by imprisonment for not more than 10 years (not more than 20 years for second and subsequent offenses) and/or a fine of not more than $250,000 (not more than $500,000 for organizations). The general espionage sentencing guideline, U.S.S.G. §2M3.2, applies to violations of paragraph (a)(1) which calls for a base sentencing level of 30 (carrying an initial sentencing range beginning at 8 years' imprisonment) and of 35 (an initial sentencing range beginning at 14 years) if top secret information is involved. Paragraph 1030(a)(1) offenses are federal crimes of terrorism. Thus, if a violation is committed for terrorist purposes, the minimum sentencing level is 32 and the criminal history category is VI which means the sentencing range begins at 17.5 years' imprisonment (and begins at 24.33 years' imprisonment if top secret information is involved). Because paragraph 1030(a)(1) is a federal crime of terrorism, the applicable statute of limitations is 8 years rather than 5 years; pretrial detention of defendants charged with a violation of paragraph 1030(a)(1) is presumed; and conviction carries the prospect of life-time supervision by probation authorities. A paragraph 1030(a)(1) offense will provide the basis for a sentencing enhancement or for additional charges, if it is committed in conjunction with aggravated identity theft; RICO; money laundering; maritime transportation of terrorists; and providing material support for terrorist organizations. Moreover, proceeds generated from a paragraph 1030(a)(1) espionage offense, as well as personal property such as computers used to facilitate the offense, are subject to confiscation. Upon conviction, defendants are ordered to pay restitution. And, offenders may also be subject to a cause of action for damages or injunctive relief. The same general observations concerning attempt, conspiracy, and aiding and abetting noted with respect to the other paragraphs of 1030(a) apply here. It is a separate crime to attempt to violate paragraph 1030(a)(7). Those who attempt or aid and abet the violation of another are subject to the same penalties as those who commit the substantive offense. The same is true of conspiracies, unless they are prosecuted under the general conspiracy statute rather than under subsection 1030(b). Conviction under the general conspiracy statute is punishable by imprisonment for not more than 5 years, regardless of the maximum penalty available for underlying substantive offense as long as the underlying offense is a felony. Espionage prosecutions are not common. And there do not appear to have been any reported cases brought under paragraph 1030(a)(1). The overlap between paragraph 1030(a)(1) and the espionage laws is such, however, that any case prosecutable under paragraph 1030(a)(1) would likely also be prosecutable under one or more of the espionage statutes; in fact "the only reported 'espionage' case involving the unauthorized use of computers was prosecuted under §793, the much older, pre-electronic espionage statute and not under §1030(a)(1)." The three espionage statutes share common ground under some circumstances. In general terms, they outlaw gathering and disseminating defense information (18 U.S.C. 793); gathering and disseminating defense information for a foreign country (18 U.S.C. 794); and disclosing classified information concerning government cryptography or communications intelligence (18 U.S.C. 798). As already noted, 18 U.S.C. 793(e) is the generic twin of 1030(a)(1), but §793 has several other provisions that might also be implicated by a fact pattern sufficient to establish criminal liability under paragraph 1030(a)(1). Section 793 establishes six distinct offenses: intruding upon military facilities to gather national defense information; copying documents containing national defense information; unlawful receipt of national defense information; unlawful dissemination of national defense information by a lawful custodian; unauthorized possession of national defense information; and negligently losing national defense information. Violations of §793 and conspiracies to violate it subject offenders to the same penalties: imprisonment for not more than 10 years (not more than 20 years for a subsequent offense) and/or a fine of not more than $250,000 (not more than $500,000 for organizations), and criminal forfeiture of any proceeds derived from the offense. Section 794 essentially subjects transgressions similar to those banned in §793 to more severe penalties, if they involve gathering national defense information for a foreign nation or to injure the United States, particularly if the offense is committed in wartime. Conspirators are subject to the same penalties, and property derived from a violation or used to facilitate a violation is subject to forfeiture. Section 798 protects military and diplomatic codes and government code breaking. It proscribes unlawful dissemination of classified information concerning communications intelligence and government cryptography. Violations are punishable by imprisonment for not more than 10 years and/or a fine of not more than $250,000, and the confiscation of any property derived from the offense or used to facilitate its commission. The economic espionage prohibition, 18 U.S.C. 1831, outlaws stealing, copying, or unlawfully possessing a trade secret for the benefit of a foreign entity or attempting or conspiring to do so. Offenders face imprisonment for not more than 15 years and a higher fine than is authorized for most felonies—not more than $5,000,000 (not more than $10 million or three times the value of the stolen trade secret for organizations). (a) Whoever— (1) having knowingly accessed a computer without authorization or exceeding authorized access, and by means of such conduct having obtained information that has been determined by the United States Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations, or any restricted data, as defined in paragraph y. of section 11 of the Atomic Energy Act of 1954, with reason to believe that such information so obtained could be used to the injury of the United States, or to the advantage of any foreign nation willfully communicates, delivers, transmits, or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it; (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (A) information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602(n) of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act 15 U.S.C. 1681 et seq.); (B) information from any department or agency of the United States; or (C) information from any protected computer; (3) intentionally, without authorization to access any nonpublic computer of a department or agency of the United States, accesses such a computer of that department or agency that is exclusively for the use of the Government of the United States or, in the case of a computer not exclusively for such use, is used by or for the Government of the United States and such conduct affects that use by or for the Government of the United States; (4) knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period; (5)(A) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; (B) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or (C) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss. (6) knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if-- (A) such trafficking affects interstate or foreign commerce; or (B) such computer is used by or for the Government of the United States . (7) with intent to extort from any person any money or other thing of value, transmits in interstate or foreign commerce any communication containing any— (A) threat to cause damage to a protected computer; (B) threat to obtain information from a protected computer without authorization or in excess of authorization or to impair the confidentiality of information obtained from a protected computer without authorization or by exceeding authorized access; or (C) demand or request for money or other thing of value in relation to damage to a protected computer, where such damage was caused to facilitate the extortion; shall be punished as provided in subsection (c) of this section. (b) Whoever conspires to commit or attempts to commit an offense under subsection (a) of this section shall be punished as provided in subsection (c) of this section. (c) The punishment for an offense under subsection (a) or (b) of this section is— (1)(A) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense under subsection (a)(1) of this section which does not occur after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; and (B) a fine under this title or imprisonment for not more than twenty years, or both, in the case of an offense under subsection (a)(1) of this section which occurs after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; (2)(A) except as provided in subparagraph (B), a fine under this title or imprisonment for not more than one year, or both, in the case of an offense under subsection (a)(2), (a)(3), or (a)(6) of this section which does not occur after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; (B) a fine under this title or imprisonment for not more than 5 years, or both, in the case of an offense under subsection (a)(2), or an attempt to commit an offense punishable under this subparagraph, if— (i) the offense was committed for purposes of commercial advantage or private financial gain; (ii) the offense was committed in furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States or of any State; or (iii) the value of the information obtained exceeds $5,000; and (C) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense under subsection (a)(2), (a)(3) or (a)(6) of this section which occurs after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; (3)(A) a fine under this title or imprisonment for not more than five years, or both, in the case of an offense under subsection (a)(4) or (a)(7) of this section which does not occur after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; and (B) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense under subsection (a)(4) or (a)(7) of this section which occurs after a conviction for another offense under this section, or an attempt to commit an offense punishable under this subparagraph; (4)(A) except as provided in subparagraphs (E) and (F), a fine under this title, imprisonment for not more than 5 years, or both, in the case of— (i) an offense under subsection (a)(5)(B), which does not occur after a conviction for another offense under this section, if the offense caused (or, in the case of an attempted offense, would, if completed, have caused)— (I) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value; (II) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals; (III) physical injury to any person; (IV) a threat to public health or safety; (V) damage affecting a computer used by or for an entity of the United States Government in furtherance of the administration of justice, national defense, or national security; or (VI) damage affecting 10 or more protected computers during any 1-year period; or (ii) an attempt to commit an offense punishable under this subparagraph; (B) except as provided in subparagraphs (E) and (F), a fine under this title, imprisonment for not more than 10 years, or both, in the case of— (i) an offense under subsection (a)(5)(A), which does not occur after a conviction for another offense under this section, if the offense caused (or, in the case of an attempted offense, would, if completed, have caused) a harm provided in subclauses (I) through (VI) of subparagraph (A)(i); or (ii) an attempt to commit an offense punishable under this subparagraph; (C) except as provided in subparagraphs (E) and (F), a fine under this title, imprisonment for not more than 20 years, or both, in the case of— (i) an offense or an attempt to commit an offense under subparagraphs (A) or (B) of subsection (a)(5) that occurs after a conviction for another offense under this section; or (ii) an attempt to commit an offense punishable under this subparagraph; (D) a fine under this title, imprisonment for not more than 10 years, or both, in the case of— (i) an offense or an attempt to commit an offense under subsection (a) (5)(C) that occurs after a conviction for another offense under this section; or (ii) an attempt to commit an offense punishable under this subparagraph; (E) if the offender attempts to cause or knowingly or recklessly causes serious bodily injury from conduct in violation of subsection (a)(5)(A), a fine under this title, imprisonment for not more than 20 years, or both; (F) if the offender attempts to cause or knowingly or recklessly causes death from conduct in violation of subsection (a)(5)(A), a fine under this title, imprisonment for any term of years or for life, or both; or (G) a fine under this title, imprisonment for not more than 1 year, or both, for— (i) any other offense under subsection (a)(5); or (ii) an attempt to commit an offense punishable under this subparagraph. [(5) Repealed.] (d)(1) The United States Secret Service shall, in addition to any other agency having such authority, have the authority to investigate offenses under this section. (2) The Federal Bureau of Investigation shall have primary authority to investigate offenses under subsection (a)(1) for any cases involving espionage, foreign counterintelligence, information protected against unauthorized disclosure for reasons of national defense or foreign relations, or Restricted Data (as that term is defined in section 11y of the Atomic Energy Act of 1954 (42 U.S.C. 2014(y)), except for offenses affecting the duties of the United States Secret Service pursuant to section 3056(a) of this title. (3) Such authority shall be exercised in accordance with an agreement which shall be entered into by the Secretary of the Treasury and the Attorney General. (e) As used in this section— (1) the term "computer" means an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device; (2) the term "protected computer" means a computer— (A) exclusively for the use of a financial institution or the United States Government, or, in the case of a computer not exclusively for such use, used by or for a financial institution or the United States Government and the conduct constituting the offense affects that use by or for the financial institution or the Government; or (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; (3) the term "State" includes the District of Columbia, the Commonwealth of Puerto Rico, and any other commonwealth, possession or territory of the United States; (4) the term "financial institution" means— (A) an institution, with deposits insured by the Federal Deposit Insurance Corporation; (B) the Federal Reserve or a member of the Federal Reserve including any Federal Reserve Bank; (C) a credit union with accounts insured by the National Credit Union Administration; (D) a member of the Federal home loan bank system and any home loan bank; (E) any institution of the Farm Credit System under the Farm Credit Act of 1971; (F) a broker-dealer registered with the Securities and Exchange Commission pursuant to section 15 of the Securities Exchange Act of 1934; (G) the Securities Investor Protection Corporation; (H) a branch or agency of a foreign bank (as such terms are defined in paragraphs (1) and (3) of section 1(b) of the International Banking Act of 1978); and (I) an organization operating under section 25 or section 25(a) of the Federal Reserve Act; (5) the term "financial record" means information derived from any record held by a financial institution pertaining to a customer's relationship with the financial institution; (6) the term "exceeds authorized access" means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter; (7) the term "department of the United States" means the legislative or judicial branch of the Government or one of the executive departments enumerated in section 101 of title 5; (8) the term "damage" means any impairment to the integrity or availability of data, a program, a system, or information; (9) the term "government entity" includes the Government of the United States, any State or political subdivision of the United States, any foreign country, and any state, province, municipality, or other political subdivision of a foreign country; (10) the term "conviction" shall include a conviction under the law of any State for a crime punishable by imprisonment for more than 1 year, an element of which is unauthorized access, or exceeding authorized access, to a computer; (11) the term "loss" means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service; and (12) the term "person" means any individual, firm, corporation, educational institution, financial institution, governmental entity, or legal or other entity. (f) This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States. (g) Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i). Damages for a violation involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages. No action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage. No action may be brought under this subsection for the negligent design or manufacture of computer hardware, computer software, or firmware. (h) The Attorney General and the Secretary of the Treasury shall report to the Congress annually, during the first 3 years following the date of the enactment of this subsection, concerning investigations and prosecutions under subsection (a)(5). (i)(1) The court, in imposing sentence on any person convicted of a violation of this section, or convicted of conspiracy to violate this section, shall order, in addition to any other sentence imposed and irrespective of any provision of State law, that such person forfeit to the United States— (A) such person's interest in any personal property that was used or intended to be used to commit or to facilitate the commission of such violation; and (B) any property, real or personal, constituting or derived from, any proceeds that such person obtained, directly or indirectly, as a result of such violation. (2) The criminal forfeiture of property under this subsection, any seizure and disposition thereof, and any judicial proceeding in relation thereto, shall be governed by the provisions of section 413 of the Comprehensive Drug Abuse Prevention and Control Act of 1970 (21 U.S.C. 853), except subsection (d) of that section. (j) For purposes of subsection (i), the following shall be subject to forfeiture to the United States and no property right shall exist in them: (1) Any personal property used or intended to be used to commit or to facilitate the commission of any violation of this section, or a conspiracy to violate this section. (2) Any property, real or personal, which constitutes or is derived from proceeds traceable to any violation of this section, or a conspiracy to violate this section. (a)(1) Whoever, knowing that the property involved in a financial transaction represents the proceeds of some form of unlawful activity, conducts or attempts to conduct such a financial transaction which in fact involves the proceeds of specified unlawful activity (A)(i) with the intent to promote the carrying on of specified unlawful activity; or (ii) with intent to engage in conduct constituting a violation of Section 7201 or 7206 of the Internal Revenue Code of 1986; or (B) knowing that the transaction is designed in whole or in part (i) to conceal or disguise the nature, the location, the source, the ownership, or the control of the proceeds of specified unlawful activity; or (ii) to avoid a transaction reporting requirement under State or Federal law, shall be sentenced to a fine of not more than $500,000 or twice the value of the property involved in the transaction, whichever is greater, or imprisonment for not more than twenty years, or both. For purposes of this paragraph, a financial transaction shall be considered to be one involving the proceeds of specified unlawful activity if it is part of a set of parallel or dependent transactions, any one of which involves the proceeds of specified unlawful activity, and all of which are part of a single plan or arrangement. (2) Whoever transports, transmits, or transfers, or attempts to transport, transmit, or transfer a monetary instrument or funds from a place in the United States to or through a place outside the United States or to a place in the United States from or through a place outside the United States— (A) with the intent to promote the carrying on of specified unlawful activity; or (B) knowing that the monetary instrument or funds involved in the transportation, transmission, or transfer represent the proceeds of some form of unlawful activity and knowing that such transportation, transmission, or transfer is designed in whole or in part— (i) to conceal or disguise the nature, the location, the source, the ownership, or the control of the proceeds of specified unlawful activity; or (ii) to avoid a transaction reporting requirement under State or Federal law, shall be sentenced to a fine of not more than $500,000 or twice the value of the monetary instrument or funds involved in the transportation, transmission, or transfer whichever is greater, or imprisonment for not more than twenty years, or both. For the purpose of the offense described in subparagraph (B), the defendant's knowledge may be established by proof that a law enforcement officer represented the matter specified in subparagraph (B) as true, and the defendant's subsequent statements or actions indicate that the defendant believed such representations to be true. (3) Whoever, with the intent (A) to promote the carrying on of specified unlawful activity; (B) to conceal or disguise the nature, location, source, ownership, or control of property believed to be the proceeds of specified unlawful activity; or (C) to avoid a transaction reporting requirement under State or Federal law, conducts or attempts to conduct a financial transaction involving property represented to be the proceeds of specified unlawful activity, or property used to conduct or facilitate specified unlawful activity, shall be fined under this title or imprisoned for not more than 20 years, or both. For purposes of this paragraph and paragraph (2), the term "represented" means any representation made by a law enforcement officer or by another person at the direction of, or with the approval of, a Federal official authorized to investigate or prosecute violations of this section. (b) Penalties.— (1) In general.—Whoever conducts or attempts to conduct a transaction described in subsection (a)(1) or (a)(3), or Section 1957, or a transportation, transmission, or transfer described in subsection (a)(2), is liable to the United States for a civil penalty of not more than the greater of (A) the value of the property, funds, or monetary instruments involved in the transaction; or (B) $10,000. (2) Jurisdiction over foreign persons.—For purposes of adjudicating an action filed or enforcing a penalty ordered under this section, the district courts shall have jurisdiction over any foreign person, including any financial institution authorized under the laws of a foreign country, against whom the action is brought, if service of process upon the foreign person is made under the Federal Rules of Civil Procedure or the laws of the country in which the foreign person is found, and— (A) the foreign person commits an offense under subsection (a) involving a financial transaction that occurs in whole or in part in the United States; (B) the foreign person converts, to his or her own use, property in which the United States has an ownership interest by virtue of the entry of an order of forfeiture by a court of the United States; or (C) the foreign person is a financial institution that maintains a bank account at a financial institution in the United States. (3) Court authority over assets.—A court may issue a pretrial restraining order or take any other action necessary to ensure that any bank account or other property held by the defendant in the United States is available to satisfy a judgment under this section. (4) Federal receiver.— (A) In general.—A court may appoint a Federal Receiver, in accordance with subparagraph (B) of this paragraph, to collect, marshal, and take custody, control, and possession of all assets of the defendant, wherever located, to satisfy a civil judgment under this subsection, a forfeiture judgment under Section 981 or 982, or a criminal sentence under Section 1957 or subsection (a) of this section, including an order of restitution to any victim of a specified unlawful activity. (B) Appointment and authority.—A Federal Receiver described in subparagraph (A)— (i) may be appointed upon application of a Federal prosecutor or a Federal or State regulator, by the court having jurisdiction over the defendant in the case; (ii) shall be an officer of the court, and the powers of the Federal Receiver shall include the powers set out in Section 754 of title 28, United States Code; and (iii) shall have standing equivalent to that of a Federal prosecutor for the purpose of submitting requests to obtain information regarding the assets of the defendant (I) from the Financial Crimes Enforcement Network of the Department of the Treasury; or (II) from a foreign country pursuant to a mutual legal assistance treaty, multilateral agreement, or other arrangement for international law enforcement assistance, provided that such requests are in accordance with the policies and procedures of the Attorney General. (c) As used in this section— (1) the term "knowing that the property involved in a financial transaction represents the proceeds of some form of unlawful activity" means that the person knew the property involved in the transaction represented proceeds from some form, though not necessarily which form, of activity that constitutes a felony under State, Federal, or foreign law, regardless of whether or not such activity is specified in paragraph (7); (2) the term "conducts" includes initiating, concluding, or participating in initiating, or concluding a transaction; (3) the term "transaction" includes a purchase, sale, loan, pledge, gift, transfer, delivery, or other disposition, and with respect to a financial institution includes a deposit, withdrawal, transfer between accounts, exchange of currency, loan, extension of credit, purchase or sale of any stock, bond, certificate of deposit, or other monetary instrument, use of a safe deposit box, or any other payment, transfer, or delivery by, through, or to a financial institution, by whatever means effected; (4) the term "financial transaction" means (A) a transaction which in any way or degree affects interstate or foreign commerce (i) involving the movement of funds by wire or other means or (ii) involving one or more monetary instruments, or (iii) involving the transfer of title to any real property, vehicle, vessel, or aircraft, or (B) a transaction involving the use of a financial institution which is engaged in, or the activities of which affect, interstate or foreign commerce in any way or degree; (5) the term "monetary instruments" means (i) coin or currency of the United States or of any other country, travelers' checks, personal checks, bank checks, and money orders, or (ii) investment securities or negotiable instruments, in bearer form or otherwise in such form that title thereto passes upon delivery; (6) the term "financial institution" includes (A) any financial institution, as defined in section 5312(a)(2) of title 31, United States Code, or the regulations promulgated thereunder; and (B) any foreign bank, as defined in section 1 of the International Banking Act of 1978 (12 U.S.C. 3101); (7) the term "specified unlawful activity" means (A) any act or activity constituting an offense listed in section 1961(1) of this title except an act which is indictable under subchapter II of chapter 53 of title 31; (B) with respect to a financial transaction occurring in whole or in part in the United States, an offense against a foreign nation involving (i) the manufacture, importation, sale, or distribution of a controlled substance (as such term is defined for the purposes of the Controlled Substances Act); (ii) murder, kidnapping, robbery, extortion, destruction of property by means of explosive or fire, or a crime of violence (as defined in Section 16); (iii) fraud, or any scheme or attempt to defraud, by or against a foreign bank (as defined in paragraph 7 of section 1(b) of the International Banking Act of 1978)); (iv) bribery of a public official, or the misappropriation, theft, or embezzlement of public funds by or for the benefit of a public official; (v) smuggling or export control violations involving— (I) an item controlled on the United States Munitions List established under section 38 of the Arms Export Control Act (22 U.S.C. 2778); or (II) an item controlled under regulations under the Export Administration Regulations (15 C.F.R. Parts 730-774); (vi) an offense with respect to which the United States would be obligated by a multilateral treaty, either to extradite the alleged offender or to submit the case for prosecution, if the offender were found within the territory of the United States; or (vii) trafficking in persons, selling or buying of children, sexual exploitation of children, or transporting, recruiting or harboring a person, including a child, for commercial sex acts; (C) any act or acts constituting a continuing criminal enterprise, as that term is defined in section 408 of the Controlled Substances Act (21 U.S.C. 848); (D) an offense under section 32 (the destruction of aircraft), section 37 (violence at international airports), section 115 (influencing, impeding, or retaliating against a Federal official by threatening or injuring a family member), section 152 (concealment of assets; false oaths and claims; bribery), section 175c (the variola virus), section 215 (commissions or gifts for procuring loans), section 351 (congressional or Cabinet officer assassination), any of sections 500 through 503 (certain counterfeiting offenses), section 513 (securities of States and private entities), section 541 (goods falsely classified), section 542 (entry of goods by means of false statements), section 545 (smuggling goods into the United States), section 549 (removing goods from Customs custody), section 554 (smuggling goods from the United States), section 555 (border tunnels), section 641 (public money, property, or records), section 656 (theft, embezzlement, or misapplication by bank officer or employee), section 657 (lending, credit, and insurance institutions), section 658 (property mortgaged or pledged to farm credit agencies), section 666 (theft or bribery concerning programs receiving Federal funds), section 793, 794, or 798 (espionage), section 831 (prohibited transactions involving nuclear materials), section 844(f) or (i) (destruction by explosives or fire of Government property or property affecting interstate or foreign commerce), section 875 (interstate communications), section 922(1) (the unlawful importation of firearms), section 924(n) (firearms trafficking), section 956 (conspiracy to kill, kidnap, maim, or injure certain property in a foreign country), section 1005 (fraudulent bank entries), 1006 (fraudulent Federal credit institution entries), 1007 (fraudulent Federal Deposit Insurance transactions), 1014 (fraudulent loan or credit applications), section 1030 (computer fraud and abuse), 1032 (concealment of assets from conservator, receiver, or liquidating agent of financial institution), section 1111 (murder), section 1114 (murder of United States law enforcement officials), section 1116 (murder of foreign officials, official guests, or internationally protected persons), section 1201 (kidnapping), section 1203 (hostage taking), section 1361 (willful injury of Government property), section 1363 (destruction of property within the special maritime and territorial jurisdiction), section 1708 (theft from the mail), section 1751 (Presidential assassination), section 2113 or 2114 (bank and postal robbery and theft), section 2252A (child pornography) where the child pornography contains a visual depiction of an actual minor engaging in sexually explicit conduct, section 2260 (production of certain child pornography for importation into the United States), section 2280 (violence against maritime navigation), section 2281 (violence against maritime fixed platforms), section 2319 (copyright infringement), section 2320 (trafficking in counterfeit goods and services), section 2332 (terrorist acts abroad against United States nationals), section 2332a (use of weapons of mass destruction), section 2332b (international terrorist acts transcending national boundaries), section 2332g (missile systems designed to destroy aircraft), section 2332h (radiological dispersal devices), section 2339A or 2339B (providing material support to terrorists), section 2339C (financing of terrorism), or section 2339D (receiving military-type training from a foreign terrorist organization) of this title, section 46502 of title 49, United States Code, a felony violation of the Chemical Diversion and Trafficking Act of 1988 (precursor and essential chemicals), section 590 of the Tariff Act of 1930 (19 U.S.C. 1590) (aviation smuggling), section 422 of the Controlled Substances Act (transportation of drug paraphernalia), section 38(c) (criminal violations) of the Arms Export Control Act, section 11 (violations) of the Export Administration Act of 1979, section 206 (penalties) of the International Emergency Economic Powers Act, section 16 (offenses and punishment) of the Trading with the Enemy Act, any felony violation of section 15 of the Food and Nutrition Act of 2008 [7 U.S.C. 2024] (supplemental nutrition assistance program benefits fraud) involving a quantity of benefits having a value of not less than $5,000, any violation of section 543(a)(1) of the Housing Act of 1949 [42 U.S.C. 1490s(a)(1)] (equity skimming), any felony violation of the Foreign Agents Registration Act of 1938, any felony violation of the Foreign Corrupt Practices Act, or section 92 of the Atomic Energy Act of 1954 (42 U.S.C. 2122) (prohibitions governing atomic weapons) ENVIRONMENTAL CRIMES (E) a felony violation of the Federal Water Pollution Control Act (33 U.S.C. 1251 et seq.), the Ocean Dumping Act (33 U.S.C. 1401 et seq.), the Act to Prevent Pollution from Ships (33 U.S.C. 1901 et seq.), the Safe Drinking Water Act (42 U.S.C. 300f et seq.), or the Resources Conservation and Recovery Act (42 U.S.C. 6901 et seq.); or (F) any act or activity constituting an offense involving a Federal health care offense; (8) the term "State" includes a State of the United States, the District of Columbia, and any commonwealth, territory, or possession of the United States. (9) the term "proceeds" means any property derived from or obtained or retained, directly or indirectly, through some form of unlawful activity, including the gross receipts of such activity. (d) Nothing in this section shall supersede any provision of Federal, State, or other law imposing criminal penalties or affording civil remedies in addition to those provided for in this section. (e) Violations of this section may be investigated by such components of the Department of Justice as the Attorney General may direct, and by such components of the Department of the Treasury as the Secretary of the Treasury may direct, as appropriate, and, with respect to offenses over which the Department of Homeland Security has jurisdiction, by such components of the Department of Homeland Security as the Secretary of Homeland Security may direct, and, with respect to offenses over which the United States Postal Service has jurisdiction, by the Postal Service. Such authority of the Secretary of the Treasury, the Secretary of Homeland Security, and the Postal Service shall be exercised in accordance with an agreement which shall be entered into by the Secretary of the Treasury, the Secretary of Homeland Security, the Postal Service, and the Attorney General. Violations of this section involving offenses described in paragraph (c)(7)(E) may be investigated by such components of the Department of Justice as the Attorney General may direct, and the National Enforcement Investigations Center of the Environmental Protection Agency. (f) There is extraterritorial jurisdiction over the conduct prohibited by this section if— (1) the conduct is by a United States citizen or, in the case of a non-United States citizen, the conduct occurs in part in the United States; and (2) the transaction or series of related transactions involves funds or monetary instruments of a value exceeding $10,000. (g) Notice of conviction of financial institutions.—If any financial institution or any officer, director, or employee of any financial institution has been found guilty of an offense under this section, section 1957 or 1960 of this title, or section 5322 or 5324 of title 31, the Attorney General shall provide written notice of such fact to the appropriate regulatory agency for the financial institution. (h) Any person who conspires to commit any offense defined in this section or section 1957 shall be subject to the same penalties as those prescribed for the offense the commission of which was the object of the conspiracy. (i) Venue.—(1) Except as provided in paragraph (2), a prosecution for an offense under this section or section 1957 may be brought in— (A) any district in which the financial or monetary transaction is conducted; or (B) any district where a prosecution for the underlying specified unlawful activity could be brought, if the defendant participated in the transfer of the proceeds of the specified unlawful activity from that district to the district where the financial or monetary transaction is conducted. (2) A prosecution for an attempt or conspiracy offense under this section or section 1957 may be brought in the district where venue would lie for the completed offense under paragraph (1), or in any other district where an act in furtherance of the attempt or conspiracy took place. (3) For purposes of this section, a transfer of funds from 1 place to another, by wire or any other means, shall constitute a single, continuing transaction. Any person who conducts (as that term is defined in subsection (c)(2)) any portion of the transaction may be charged in any district in which the transaction takes place. As used in this chapter— (1) "racketeering activity means (A) any act or threat involving murder, kidnapping, gambling, arson, robbery, bribery, extortion, dealing in obscene matter, or dealing in a controlled substance or listed chemical (as defined in section 102 of the Controlled Substances Act), which is chargeable under State law and punishable by imprisonment for more than one year; (B) any act which is indictable under any of the following provisions of title 18, United States Code: section 201 (bribery), section 224 (sports bribery), sections 471, 472, and 473 (counterfeiting), section 659 (theft from interstate shipment) if the act indictable under section 659 is felonious, section 664 (embezzlement from pension and welfare funds), sections 891-894 (extortionate credit transactions), section 1028 (fraud and related activity in connection with identification documents), section 1029 (fraud and related activity in connection with access devices), section 1084 (the transmission of gambling information), section 1341 (mail fraud), section 1343 (wire fraud), section 1344 (financial institution fraud), section 1351 (fraud in foreign labor contracting), section 1425 (the procurement of citizenship or nationalization unlawfully), section 1426 (the reproduction of naturalization or citizenship papers), section 1427 (the sale of naturalization or citizenship papers), sections 1461-1465 (obscene matter), section 1503 (obstruction of justice), section 1510 (obstruction of criminal investigations), section 1511 (the obstruction of State or local law enforcement), section 1512 (tampering with a witness, victim, or an informant), section 1513 (retaliating against a witness, victim, or an informant), section 1542 (false statement in application and use of passport), section 1543 (forgery or false use of passport), section 1544 (misuse of passport), section 1546 (fraud and misuse of visas, permits, and other documents), sections 1581-1592 (peonage, slavery, and trafficking in persons), section 1951 (interference with commerce, robbery, or extortion), section 1952 (racketeering), section 1953 (interstate transportation of wagering paraphernalia), section 1954 (unlawful welfare fund payments), section 1955 (the prohibition of illegal gambling businesses), section 1956 (the laundering of monetary instruments), section 1957 (engaging in monetary transactions in property derived from specified unlawful activity), section 1958 (use of interstate commerce facilities in the commission of murder-for-hire), section 1960 (illegal money transmitters), sections 2251, 2251A, 2252, and 2260 (sexual exploitation of children), sections 2312 and 2313 (interstate transportation of stolen motor vehicles), sections 2314 and 2315 (interstate transportation of stolen property), section 2318 (trafficking in counterfeit labels for phonorecords, computer programs or computer program documentation or packaging and copies of motion pictures or other audiovisual works), section 2319 (criminal infringement of a copyright), section 2319A (unauthorized fixation of and trafficking in sound recordings and music videos of live musical performances), section 2320 (trafficking in goods or services bearing counterfeit marks), section 2321 (trafficking in certain motor vehicles or motor vehicle parts), sections 2341-2346 (trafficking in contraband cigarettes), sections 2421-24 (white slave traffic), sections 175-178 (biological weapons), sections 229-229F (chemical weapons), section 831 (nuclear materials), (C) any act which is indictable under title 29, United States Code, section 186 (dealing with restrictions on payments and loans to labor organizations) or section 501(c) (embezzlement from union funds), (D) any offense involving fraud connected with a case under title 11 (except a case under Section 157 of this title), fraud in the sale of securities, or the felonious manufacture, importation, receiving, concealment, buying, selling, or otherwise dealing in a controlled substance or listed chemical (as defined in section 102 of the Controlled Substances Act), punishable under any law of the United States, (E) any act which is indictable under the Currency and Foreign Transactions Reporting Act, (F) any act which is indictable under the Immigration and Nationality Act, section 274 (bringing in and harboring certain aliens), section 277 (aiding or assisting certain aliens to enter the United States), or section 278 (importation of alien for immoral purpose) if the act indictable under such section of such Act was committed for the purpose of financial gain, or (G) any act that is indictable under any provision listed in section 2332b(g)(5)(B). (g) Definitions—As used in this section— * * * (5) the term "Federal crime of terrorism" means an offense that ... (B) is a violation of— (i) section 32 (destruction of aircraft or aircraft facilities), 37 (violence at international airports), 81 (arson within special maritime and territorial jurisdiction), 175 or 175b (biological weapons), 175c (variola virus), 229 (chemical weapons), subsection (a), (b), (c), or (d) of section 351 (congressional, cabinet, and Supreme Court assassination and kidnapping), 831 (nuclear materials), 832 (participation in nuclear and weapons of mass destruction threats to the United States) 842(m) or (n) (plastic explosives), 844(f)(2) or (3) (arson and bombing of Government property risking or causing death), 844(i) (arson and bombing of property used in interstate commerce), 930(c) (killing or attempted killing during an attack on a Federal facility with a dangerous weapon), 956(a)(1) (conspiracy to murder, kidnap, or maim persons abroad), 1030(a)(1) (protection of computers), 1030(a)(5)(A) resulting in damage as defined in 1030 (c)(4)(A)(i)(II) through (VI)(protection of computers), 1114 (killing or attempted killing of officers and employees of the United States), 1116 (murder or manslaughter of foreign officials, official guests, or internationally protected persons), 1203 (hostage taking), 1361 (government property or contracts), 1362 (destruction of communication lines, stations, or systems), 1363 (injury to buildings or property within special maritime and territorial jurisdiction of the United States), 1366(a) (destruction of an energy facility), 1751(a), (b), (c), or (d) (Presidential and Presidential staff assassination and kidnapping), 1992 (terrorist attacks and other acts of violence against railroad carriers and against mass transportation systems on land, on water, or through the air), 2155 (destruction of national defense materials, premises, or utilities), 2156 (national defense material, premises, or utilities), 2280 (violence against maritime navigation), 2281 (violence against maritime fixed platforms), 2332 (certain homicides and other violence against United States nationals occurring outside of the United States), 2332a (use of weapons of mass destruction), 2332b (acts of terrorism transcending national boundaries), 2332f (bombing of public places and facilities), 2332g (missile systems designed to destroy aircraft), 2332h (radiological dispersal devices), 2339 (harboring terrorists), 2339A (providing material support to terrorists), 2339B (providing material support to terrorist organizations), 2339C (financing of terrorism), 2339D (military-type training from a foreign terrorist organization), or 2340A (torture) of this title; (ii) sections 92 (prohibitions governing atomic weapons) or 236 (sabotage of nuclear facilities or fuel) of the Atomic Energy Act of 1954 (42 U.S.C. 2122 or 2284); (iii) section 46502 (aircraft piracy), the second sentence of section 46504 (assault on a flight crew with a dangerous weapon), Section 46505(b)(3) or (c) (explosive or incendiary devices, or endangerment of human life by means of weapons, on aircraft), section 46506 if homicide or attempted homicide is involved (application of certain criminal laws to acts on aircraft), or section 60123(b) (destruction of interstate gas or hazardous liquid pipeline facility) of title 49; or (iv) section 1010A of the Controlled Substances Import and Export Act (narco-terrorism).

Summary: The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030, outlaws conduct that victimizes computer systems. It is a cyber security law. It protects federal computers, bank computers, and computers connected to the Internet. It shields them from trespassing, threats, damage, espionage, and from being corruptly used as instruments of fraud. It is not a comprehensive provision, but instead it fills cracks and gaps in the protection afforded by other federal criminal laws. This is a brief sketch of CFAA and some of its federal statutory companions, including the amendments found in the Identity Theft Enforcement and Restitution Act, P.L. 110-326, 122 Stat. 3560 (2008). In their present form, the seven paragraphs of subsection 1030(a) outlaw computer trespassing (e.g., hacking) in a government computer, 18 U.S.C. 1030(a)(3); computer trespassing (e.g., hacking) resulting in exposure to certain governmental, credit, financial, or computer-housed information, 18 U.S.C. 1030(a)(2); damaging a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce (e.g., a worm, computer virus, Trojan horse, time bomb, a denial of service attack, and other forms of cyber attack, cyber crime, or cyber terrorism), 18 U.S.C. 1030(a)(5); committing fraud an integral part of which involves unauthorized access to a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce, 18 U.S.C. 1030(a)(4); threatening to damage a government computer, a bank computer, or a computer used in, or affecting, interstate or foreign commerce, 18 U.S.C. 1030(a)(7); trafficking in passwords for a government computer, or when the trafficking affects interstate or foreign commerce, 18 U.S.C. 1030(a)(6); and accessing a computer to commit espionage, 18 U.S.C. 1030(a)(1). Subsection 1030(b) makes it a crime to attempt or conspire to commit any of these offenses. Subsection 1030(c) catalogs the penalties for committing them, penalties that range from imprisonment for not more than a year for simple cyberspace trespassing to a maximum of life imprisonment when death results from intentional computer damage. Subsection 1030(d) preserves the investigative authority of the Secret Service. Subsection 1030(e) supplies common definitions. Subsection 1030(f) disclaims any application to otherwise permissible law enforcement activities. Subsection 1030(g) creates a civil cause of action for victims of these crimes. Subsections 1030(i) and (j) authorize forfeiture of tainted property. This report is available in abbreviated form—without the footnotes, citations, quotations, or appendixes found in this report—under the title CRS Report RS20830, Cybercrime: A Sketch of 18 U.S.C. 1030 and Related Federal Criminal Laws, by [author name scrubbed].