New Jersey Federal Computer Fraud & Hacking Lawyer

Computer crimes are investigated and prosecuted differently from most other offenses. The evidence is digital, the investigations often span multiple states and countries, and federal agencies, particularly the FBI’s cyber squads and the U.S. Secret Service, take the lead. New Jersey is a hub for the financial services, pharmaceutical, telecommunications and technology industries, which makes it both a frequent target of cyberattacks and a frequent venue for prosecutions of people accused of hacking, data theft, account takeovers, ransomware, and misuse of employer systems. If you are under investigation or charged, a New Jersey federal computer fraud lawyer can evaluate whether the government’s theory even fits the narrowed federal statute.

Keith Oliver Criminal Law defends clients facing federal cybercrime charges in the District of New Jersey. We work with independent digital forensics experts to examine the government’s evidence and to test how devices were seized, imaged and analyzed.

The Computer Fraud and Abuse Act (CFAA)

The primary federal hacking statute is the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. It applies to “protected computers,” a term that covers any computer used in or affecting interstate or foreign commerce, which means virtually every device connected to the internet. The most commonly charged subsections are:

• § 1030(a)(2) – intentionally accessing a computer without authorization or exceeding authorized access, and thereby obtaining information.
• § 1030(a)(4) – knowingly and with intent to defraud accessing a protected computer without authorization, furthering the fraud and obtaining anything of value.
• § 1030(a)(5) – knowingly transmitting a program, code or command that intentionally causes damage, or intentionally accessing a computer without authorization and recklessly causing damage. This covers malware, ransomware, denial-of-service attacks and destructive insider conduct.
• § 1030(a)(6) – trafficking in passwords or similar access information with intent to defraud.
• § 1030(a)(7) – transmitting threats to damage a computer or to disclose stolen data in order to extort money, the classic ransomware demand.

Van Buren and the Limits of “Exceeding Authorized Access”

For years, prosecutors argued that employees “exceeded authorized access” whenever they used data they could lawfully see for an improper purpose, such as checking a database for personal reasons. In Van Buren v. United States (2021), the Supreme Court rejected that view. A person exceeds authorized access only when he accesses parts of a computer system, such as files, folders or databases, that are off-limits to him. The Court described this as a “gates-up-or-down” inquiry: if you were permitted to enter that area of the system, your purpose in doing so does not make the access a federal crime under the CFAA.

Van Buren substantially narrowed CFAA liability for employees, contractors and others with legitimate credentials. However, it did not eliminate other theories. Using a former employer’s credentials after termination, using someone else’s password, or bypassing technical barriers can still be “without authorization.” Misusing data can also violate trade secret law, wire fraud statutes or privacy laws. A careful analysis of exactly what systems were accessed, with what credentials and under what policies, is the starting point of any defense.

Other Federal Cybercrime Statutes

• Wire fraud, 18 U.S.C. § 1343, for phishing, business email compromise and online fraud schemes. See our wire fraud page.
• Access device fraud, 18 U.S.C. § 1029, for trafficking in stolen credit card numbers, card skimmers and account credentials.
• Aggravated identity theft, 18 U.S.C. § 1028A, which carries a mandatory two-year consecutive sentence. See our identity theft page.
• Theft of trade secrets, 18 U.S.C. § 1832, and economic espionage, § 1831, for taking proprietary information, source code, formulas or customer data.
• The Wiretap Act, 18 U.S.C. § 2511, for intercepting communications, and the Stored Communications Act, 18 U.S.C. § 2701, for accessing stored emails and messages without authorization.
• Cyberstalking, 18 U.S.C. § 2261A, and interstate threats, § 875, for online harassment and threats.

Penalties for Federal Computer Crimes

CFAA penalties depend on the subsection charged, the purpose of the access, the value of information obtained, the harm caused and whether the defendant has prior CFAA convictions. A basic unauthorized access offense under § 1030(a)(2) is a misdemeanor, but it becomes a five-year felony if committed for commercial advantage or private financial gain, in furtherance of another crime, or if the information is worth more than $5,000. Intentional damage offenses carry up to ten years, and damage that causes serious bodily injury carries up to 20 years, with a maximum of life if death results.

Under the Sentencing Guidelines, most CFAA offenses are sentenced under § 2B1.1, the fraud and theft guideline. The loss amount includes the reasonable costs to the victim of responding to the offense, conducting a damage assessment, restoring data and systems, and lost revenue due to interruption of service. Because incident-response costs can be large, loss figures in hacking cases often far exceed any money the defendant actually received. Additional enhancements apply for offenses involving critical infrastructure, for intent to obtain personal information, and for the use of sophisticated means. Forfeiture of computers and devices used in the offense is routine, and courts frequently impose supervised release conditions that restrict internet use.

How Cybercrime Investigations Work

Federal cyber investigations commonly begin when a company reports an intrusion to the FBI or Secret Service, when a financial institution detects fraudulent transactions, or when agents identify a suspect through cryptocurrency tracing, server logs or an informant in an online forum. Investigators use subpoenas and court orders under the Stored Communications Act to obtain subscriber information, IP logs and account records from internet service providers, email providers and platforms. They may then obtain search warrants for homes and devices.

When a search warrant is executed, agents typically seize every phone, laptop, tablet, external drive and gaming console in the home, and create forensic images for analysis. Defendants are frequently surprised by how much data is recovered, including deleted files, chat logs and browser histories. Attribution, however, is often the weakest point of the government’s case: proving that a particular person, rather than another member of the household, a roommate or a remote intruder, was using the device or account at the relevant time.

Defenses to Federal Computer Fraud Charges

• Authorization. The defendant had permission to access the system or data, or reasonably believed he did. After Van Buren, misuse of permitted access is not a CFAA violation.
• Attribution. The government cannot prove who was behind the keyboard. Shared devices, open Wi-Fi networks, VPNs, compromised accounts and malware on the defendant’s own computer all create reasonable doubt.
• Lack of intent. Many CFAA subsections require intentional or knowing conduct, and fraud-based subsections require intent to defraud.
• Loss and damage challenges. Felony thresholds and sentencing enhancements depend on loss figures that are often inflated by including costs unrelated to the offense.
• Fourth Amendment issues. Overbroad warrants, searches exceeding the scope of a warrant, delays in searching seized devices, and improper use of geofence or tower dump data can be challenged.
• Good-faith security research. Under DOJ’s 2022 charging policy, good-faith security research should not be prosecuted under the CFAA.

Insiders, Employees and Departing Workers

A significant share of computer-related prosecutions involve insiders, not anonymous hackers: an IT administrator who disrupts systems after being fired, a salesperson who downloads a customer list before joining a competitor, or a researcher accused of taking proprietary data overseas. These cases often begin as civil disputes between employers and former employees, with the employer later referring the matter to the FBI. If you are a departing employee accused of taking data, it is critical to stop accessing company systems, preserve but do not use or distribute any disputed files, and consult counsel before returning devices or responding to demands, so that you do not inadvertently create evidence against yourself or destroy evidence that could help you.

Related charges are discussed on our pages for wire fraud, identity theft, bank fraud and money laundering, which is often charged when cryptocurrency is used to move proceeds.

Federal vs. New Jersey State Computer Crime Charges

New Jersey’s Computer Related Offenses statute, N.J.S.A. 2C:20-23 through 2C:20-34, criminalizes unauthorized access, alteration and damage to computer systems, with grades ranging from a disorderly persons offense to a second-degree crime depending on the value involved and the type of data. State prosecutors handle many smaller cases, while federal prosecutors take cases involving large losses, critical infrastructure, interstate or international actors, financial institutions and organized groups. Federal cases often carry longer sentences and complex forfeiture and restitution, making early defense involvement important to determine where a case is headed.

Ransomware, Business Email Compromise and Cryptocurrency

Two categories of cyber-enabled crime receive particular attention from federal prosecutors today. The first is ransomware and data-extortion activity, in which attackers encrypt or steal a victim’s data and demand payment, typically in cryptocurrency. Prosecutors charge not only the people who deploy the malware but also “affiliates,” initial access brokers who sell network credentials, and people who launder ransom payments. The second is business email compromise, in which a fraudster impersonates an executive, vendor or real estate closing agent and redirects a wire transfer. Business email compromise cases often reach “money mules” who opened accounts to receive the funds, many of whom did not understand the larger scheme.

Cryptocurrency tracing plays a central role in both. Blockchain analytics firms help agents follow funds across wallets and exchanges, and exchanges respond to subpoenas with identity verification records. Those analyses are not infallible. Clustering heuristics, mixing services and shared wallets can lead to mistaken attribution, and defense experts can test the government’s conclusions about who controlled a given wallet.

If you have been contacted about a cyber investigation, do not log into the accounts at issue, wipe devices or move cryptocurrency. Each of those actions can be portrayed as consciousness of guilt or charged as obstruction. Instead, preserve everything and speak with a federal defense lawyer about how to respond.

Related Federal Defense Guides

• Federal credit card and access device fraud
• Federal identity theft and aggravated identity theft
• Federal wire fraud
• Federal threats, cyberstalking and assault on a federal officer

Frequently Asked Questions

Is it a federal crime to log into someone else’s email or social media account?

It can be. Accessing an account without authorization and obtaining information can violate 18 U.S.C. § 1030(a)(2) and the Stored Communications Act. Simple first-offense cases without commercial gain may be misdemeanors, but aggravating facts can make them felonies. New Jersey also has its own computer crime statute, N.J.S.A. 2C:20-25.

Can I be charged for taking company files when I leave my job?

Possibly, though Van Buren v. United States (2021) narrowed the CFAA so that misusing data you were entitled to access is not “exceeding authorized access.” Departing employees may still face trade secret theft charges under 18 U.S.C. § 1832 or civil claims, depending on what was taken and why.

What is the statute of limitations for computer crimes?

Generally five years under 18 U.S.C. § 3282. Civil CFAA claims must be filed within two years of the act or of the discovery of the damage.

Do federal agents need a warrant to search my phone or computer?

Generally yes. Under Riley v. California and the Fourth Amendment, a warrant is usually required to search the contents of a phone or computer, and warrants must describe what may be searched with particularity. Overbroad digital warrants can be challenged.

Is security research or penetration testing a crime?

Authorized testing is not. DOJ policy since 2022 directs prosecutors not to charge good-faith security research under the CFAA, but the line between authorized and unauthorized testing depends on the scope of permission, so researchers should document authorization carefully.

Talk to a New Jersey Federal Defense Lawyer Today

Federal cases are won or lost early, often before an indictment is ever filed. If an agent has contacted you, a search warrant has been executed, or you have received a target letter or grand jury subpoena, call Keith Oliver Criminal Law at (732) 858-6959 or contact us online for a confidential consultation. We defend clients throughout New Jersey in the U.S. District Court in Newark, Trenton and Camden, with offices in Monmouth, Mercer and Somerset Counties and Jersey City. Learn more about our federal criminal defense practice and attorney Keith G. Oliver.