Computer Crime Laws by State (2026)
How each state handles computer hacking and cybercrime and the penalties, from each state's code.
| State | Computer hacking and cybercrime |
|---|---|
| Alabama | Hacking is called computer tampering in Alabama: knowingly accessing and altering or damaging a computer or network without authority or beyond authorization, deleting data, taking programs or data, introducing a virus, causing a denial of service, or giving out passwords or other security information. It is a Class A misdemeanor, a Class C felony if done to commit an unlawful act, get a benefit or defraud or harm someone, a Class B felony if the victim's expenses exceed $2,500 or public services or government operations are disrupted (or if criminal justice information systems are involved), and a Class A felony if the victim's expenses exceed $100,000 or someone is physically injured. Using a card scanner or re-encoder to steal or copy card data with intent to defraud (encoded data fraud) is a Class C felony. Ala. Code 1975 §§ 13A-8-112, 13A-8-113 |
| Alaska | Knowingly accessing a computer, system or network without the right to do so, or exceeding authorized access, and in doing so obtaining information about a person or proprietary information, inserting false information, introducing a program that tampers with, disrupts, disables or destroys a computer, or encrypting or decrypting data (which covers ransomware-style attacks), is 'criminal use of a computer.' Installing or using a keystroke logger to record another person's entries is also covered. Criminal use of a computer is a class C felony (up to 5 years and $50,000). AS 11.46.740; AS 12.55.035, 12.55.125, 12.55.135 |
| Arizona | Hacking is called computer tampering in Arizona: acting without authority or beyond authorization to access, alter or damage a computer system to defraud, delete or destroy data, introduce a computer contaminant (malware), disrupt services, use a computer to seriously alarm or terrorize someone, keep a user from leaving a site, or get confidential government or health information. Tampering to defraud is a class 3 felony. Altering data, planting malware or disrupting service is a class 4 felony, or class 2 if the target is a critical infrastructure resource. Using a computer to terrorize someone is a class 5 felony, and getting confidential information or simply accessing a system without authority is a class 6 felony. A.R.S. § 13-2316 |
| Arkansas | Computer trespass (intentionally and without authorization accessing, altering, deleting, damaging, destroying or disrupting a computer, network, program or data) is a Class C misdemeanor for a first offense with no loss, a Class B misdemeanor for a repeat or loss under $500, a Class A misdemeanor for loss of $500 to under $2,500, and a Class D felony (up to 6 years) for loss of $2,500 or more. Computer fraud (accessing a computer to carry out a scheme to defraud or extort, or to obtain money, property or services by false representations) is a Class D felony. Ark. Code Ann. §§ 5-41-104, 5-41-103 |
| California | California's computer crime law covers knowingly accessing and altering, damaging, deleting or using data or computer systems without permission to defraud or wrongfully get money or property, taking or copying data, disrupting computer services, and introducing a computer virus or other contaminant. The main hacking and fraud offenses can be charged as a misdemeanor or felony: up to 1 year in county jail and/or $5,000, or 16 months, 2 or 3 years under Pen. Code 1170(h) and up to $10,000. Using computer services without permission is a misdemeanor for a first violation of $950 or less without injury, and can be charged as a felony above that or when the victim's loss exceeds $5,000; some lesser access offenses start as infractions up to $1,000. Introducing ransomware to extort property is punished as extortion. Cal. Pen. Code 502(c)-(d), 523; Pen. Code 17, 18, 19, 1170(h) |
| Colorado | Colorado calls hacking 'cybercrime': knowingly accessing or using a computer system without authorization or beyond it, accessing one to defraud or steal, damaging or disrupting a system, or transmitting code meant to cause damage. Simple unauthorized access is a class 2 misdemeanor; otherwise the grade follows the loss or damage, from a petty offense (under $300) and misdemeanors up to $2,000, to a class 6 felony ($2,000-$5,000), class 5 ($5,000-$20,000), class 4 ($20,000-$100,000), class 3 ($100,000-$1 million) and class 2 felony ($1 million or more). Using a computer to arrange child prostitution or skimming or re-encoding payment cards is a class 5 felony, and using ticket bots to get around purchase limits is a class 2 misdemeanor per ticket. C.R.S. § 18-5.5-102 |
| Connecticut | Computer crime covers unauthorized access to a computer system, theft of computer services, interrupting or degrading computer services, misuse of computer data (including altering or deleting it), and destroying computer equipment. It is graded by the damage or value involved: more than $10,000 is a class B felony (1 to 20 years); more than $5,000 a class C felony; more than $1,000, or recklessly creating a risk of serious physical injury, a class D felony; more than $500 a class A misdemeanor; and $500 or less a class B misdemeanor. The court may instead fine up to double the offender's gain. Planting ransomware and demanding payment is computer extortion, a class E felony (up to 3 years). Conn. Gen. Stat. §§ 53a-251 to 53a-257, 53a-262 |
| Delaware | Delaware's computer crimes include unauthorized access to a computer system, theft of computer services, interrupting computer services, misusing or altering computer data, destroying computer equipment, and sending unrequested bulk email with forged routing. They are graded by the damage or value involved: more than $10,000 is a class D felony (up to 8 years); more than $5,000 a class E felony (up to 5 years); $1,500 or more, or conduct creating a risk of serious physical injury, a class G felony (up to 2 years); under $1,500 a class A misdemeanor. Victims may also sue. No separate ransomware offense was found in this part of the code. 11 Del. C. §§ 931-941 |
| Florida | Knowingly and without authorization accessing a computer, network or electronic device, disrupting service, damaging equipment, introducing a computer contaminant (such as malware or ransomware), or secretly using a device's camera or microphone for surveillance is a third-degree felony (up to 5 years). It is a second-degree felony (up to 15 years) if damage is $5,000 or more, the purpose is fraud, or it disrupts government, public utilities or public transit systems, and a first-degree felony (up to 30 years) if it endangers human life or disrupts medical equipment. Modifying computer equipment without authorization is a first-degree misdemeanor. Victims may also sue, and devices used may be forfeited. Fla. Stat. § 815.06 |
| Georgia | Georgia's Computer Systems Protection Act makes it a crime to knowingly use a computer or network without authority to take or obtain property (computer theft), to delete or remove programs or data (computer trespass), to examine someone's personal, medical or financial data (computer invasion of privacy), or to alter data in a way that would be forgery on paper (computer forgery). Each is punishable by up to 15 years in prison, a fine of up to $50,000, or both. Knowingly disclosing a password or access code without authority causing more than $500 in damage carries up to 1 year and a $5,000 fine. No ransomware-specific provision appears in this section. O.C.G.A. § 16-9-93(a)-(e), (h) |
| Hawaii | Knowingly accessing a computer, system or network without authorization is unauthorized computer access in the third degree, a class C felony (5 years). If the person thereby obtains information it is second degree, a class B felony (10 years). It is first degree, a class A felony (20 years), if the access was for financial gain or to further another crime, the information is worth more than $20,000, or the information is legally protected from disclosure. Haw. Rev. Stat. §§ 708-895.5, 708-895.6, 708-895.7 |
| Idaho | Idaho's computer crime law covers three kinds of conduct. Knowingly accessing or using a computer, system or network to carry out a scheme to defraud, obtain money, property or services by false pretenses, or commit theft is a felony, as is knowingly and without authorization altering, damaging or destroying a computer, network, software or data. Simply accessing or using a computer, system or network without authorization (hacking without damage or fraud) is a misdemeanor. The statute does not set its own prison term, so the general penalties apply: a felony up to 5 years and/or $50,000, and a misdemeanor up to 6 months and/or $1,000. Idaho Code §§ 18-2202, 18-112, 18-113 |
| Illinois | Computer tampering (accessing a computer, network, program or data without authorization or beyond authorization) is a Class B misdemeanor (up to 6 months); doing so and obtaining data or services is a Class A misdemeanor (Class 4 felony for a repeat); and accessing and damaging, deleting or altering programs or data, or inserting a harmful program such as a virus, is a Class 4 felony (Class 3 for a repeat). Aggravated computer tampering that disrupts vital government or public utility services is a Class 3 felony, or a Class 2 felony if it creates a strong probability of death or great bodily harm. Computer fraud (accessing a computer to carry out a scheme to defraud) is a Class 4 felony; damaging a computer or data as part of a fraud is a Class 3 felony; and obtaining money, property or services is a Class 4 felony up to $1,000, a Class 3 felony up to $50,000, and a Class 2 felony at $50,000 or more, with property forfeiture. 720 ILCS 5/17-50, 5/17-51, 5/17-52; 730 ILCS 5/5-4.5-25 to -65 |
| Indiana | Accessing a computer, computer system or network without the owner's consent is computer trespass, a Class A misdemeanor (up to 1 year). Without authorization disrupting or denying computer services, damaging a computer, system or network or its equipment, or introducing a computer contaminant (such as malware) is an offense against computer users, a Level 6 felony (6 months to 2 1/2 years); it is a Level 5 felony (1 to 6 years) if the loss is $750 to under $50,000, it is done to defraud or obtain property, or it impairs government operations or public utilities, and a Level 4 felony (2 to 12 years) if the loss is $50,000 or more or it endangers human life. Modifying, destroying, or taking trade secrets or confidential data or programs without authorization is a Level 6 felony. IC 35-43-2-3(b), 35-43-1-8, 35-43-1-7; IC 35-50-2-4 to -7, 35-50-3-2 to -4 |
| Iowa | Knowingly accessing a computer, system or network without authorization is a simple misdemeanor, a serious misdemeanor if data is copied, altered or deleted, and an aggravated misdemeanor if the data is a confidential government record, a trade secret, or operational data of a utility, rural water district or public airport. Iowa's Computer Spyware, Malware, and Ransomware Protection Act separately bans ransomware-type attacks (unauthorized access meant to disrupt or damage systems or data, or misuse of access codes): an aggravated misdemeanor for losses under $10,000, a class D felony for $10,000 to under $50,000, and a class C felony for $50,000 or more. Deceptively installing spyware or malware is an aggravated misdemeanor, or a class D felony if losses exceed $1,000. Iowa Code §§ 716.6B, 715.9, 715.10, 715.4, 715.7 (Iowa Code 2026) |
| Kansas | Knowingly and without authorization accessing a computer, system or network and damaging, altering, destroying, copying, disclosing or taking data or property, exceeding authorized access to do the same, or using a computer to carry out a scheme to defraud, is a severity level 8 nonperson felony, or a severity level 5 nonperson felony if the victims lose more than $100,000. Unauthorized access alone (including to a social networking account) or disclosing someone's password or access code without authorization is a class A nonperson misdemeanor (up to 1 year). Felony prison ranges come from the sentencing grid, which combines the severity level with criminal history. K.S.A. 21-5839 |
| Kentucky | Kentucky grades unlawful access to a computer by purpose and harm. Accessing a computer, network, program or data without the owner's consent to carry out a scheme to defraud or to obtain money, property or services by false pretenses is first degree, a Class C felony (5 to 10 years). Unauthorized access causing $300 or more in loss or damage is second degree, a Class D felony (1 to 5 years); under $300 is third degree, a Class A misdemeanor (up to 12 months); and unauthorized access with no loss or damage is fourth degree, a Class B misdemeanor (up to 90 days). Receiving or using the proceeds of a first-degree violation is misuse of computer information, a Class C felony. KRS 434.845, 434.850, 434.851, 434.853, 434.855, 532.060, 532.090 |
| Louisiana | Hacking is mainly charged as computer tampering: knowingly accessing, copying, damaging or altering a computer or its data without the owner's authorization. Unauthorized access or copying carries up to six months and/or a $500 fine; damaging data, deleting programs or introducing malicious code carries up to 5 years with or without hard labor and/or a $10,000 fine, and up to 15 years at hard labor if intended to disrupt vital government or utility services or to cause death or great bodily harm. Computer fraud (accessing a computer to defraud or obtain money or property) carries up to 5 years and/or a $10,000 fine. Denying an authorized user access to a computer carries up to six months and/or $500, or up to 5 years and/or $10,000 if the loss is $500 or more. Trespass against state computers carries up to 3 years for a first offense and up to 5 years for a repeat. La. R.S. 14:73.7; R.S. 14:73.5; R.S. 14:73.4; R.S. 14:73.12 |
| Maine | Hacking is called criminal invasion of computer privacy: intentionally accessing any computer resource knowing one is not authorized to do so, a Class D crime (less than 1 year and up to $2,000). Aggravated criminal invasion of computer privacy (intentionally making an unauthorized copy of a computer program or information, knowingly damaging another's computer resource, or introducing a computer virus) is a Class C crime (up to 5 years and $5,000). 17-A M.R.S. §§ 432, 433; §§ 1604(1), 1704 |
| Maryland | Hacking is unauthorized access to computers: intentionally, willfully and without authorization accessing or exceeding authorized access to a computer, network, software or database is a misdemeanor punishable by up to 3 years and/or $1,000. Doing so to cause a malfunction or to alter, damage or destroy data or programs, or misusing access codes, is a misdemeanor with up to 5 years and/or $5,000 if the loss is under $10,000, and a felony with up to 10 years and/or $10,000 if the loss is $10,000 or more. Attacks meant to disrupt state government, utilities, health care facilities or public schools carry up to 10 years and/or $100,000 for losses of $10,000 or more. Knowingly possessing ransomware intending to use it on someone else's computer is a misdemeanor with up to 2 years and/or $5,000, and attacks on 9-1-1 call centers are a felony with up to 5 years and/or $25,000. Md. Code, Crim. Law § 7-302(c)-(d) |
| Massachusetts | Unauthorized computer access means knowingly accessing a computer system by any means without authorization, or staying on after learning access is not authorized; requiring a password or other authentication is notice that access is limited. It is punishable by up to 30 days in a house of correction and/or a fine up to $1,000. Damaging data or systems may also be charged under other property-crime statutes. G.L. c. 266, § 120F |
| Michigan | Michigan's computer crime law makes it a crime to intentionally access a computer to carry out a fraud scheme or obtain money, property or services by false pretenses; penalties follow the amount involved, from a misdemeanor punishable by up to 93 days (under $200) up to a felony punishable by up to 10 years ($20,000 or more, or three or more priors). Intentionally accessing a computer or network without authorization (or by exceeding authorization) to acquire, alter, damage, delete or destroy property, or inserting a harmful program, is a felony punishable by up to 5 years and/or $10,000, or up to 10 years and/or $50,000 with a prior conviction. Using a computer to commit another crime carries a separate penalty tied to the underlying crime, up to 20 years. MCL 752.794, 752.795, 752.796, 752.797 |
| Minnesota | Unauthorized computer access means intentionally and without authorization penetrating, or trying to penetrate, a computer security system or electronic terminal. It is a misdemeanor (up to 90 days and/or $1,000); a gross misdemeanor (up to 364 days and/or $3,000) if it creates a risk to public health and safety, compromises protected or nonpublic data, or gains access to personal data; and a felony punishable by up to 10 years and/or $20,000 if it creates a grave risk of death, or on a second gross misdemeanor violation. Computer damage (intentionally damaging, destroying or altering a computer, system or software) is punished by value of the loss: up to 90 days for small losses, up to 5 years and/or $10,000 for losses over $500, and up to 10 years and/or $50,000 for losses over $2,500. Minn. Stat. §§ 609.891, 609.88 |
| Mississippi | Mississippi's computer crime laws cover computer fraud (accessing a computer or network to defraud, to get money, property or services by false pretenses, or to insert harmful programs such as viruses), offenses against computer users (denying an authorized user access, or disclosing passwords or access codes without consent), and damaging computer equipment. Each is graded by the damage or loss: under $1,000 is a misdemeanor (up to $1,000 and 6 months in county jail); $1,000 to under $5,000 carries up to 5 years and $10,000; $5,000 to under $25,000 up to 10 years and $10,000; and $25,000 or more up to 20 years and $10,000. A third or later low-value offense of at least $500 carries up to 3 years. Miss. Code Ann. §§ 97-45-3, 97-45-5, 97-45-7 |
| Missouri | Missouri's computer tampering laws cover tampering with computer data (altering, destroying, taking or disclosing data or passwords without authorization, or accessing a computer to examine information about another person), tampering with computer equipment, and tampering with computer users (unauthorized access or denying service to an authorized user). Each is a class A misdemeanor (up to 1 year), or a class E felony (up to 4 years) when done to defraud or obtain property worth $750 or more; damaging equipment or systems by $750 or more is a class E felony, and by $25,000 or more a class D felony (up to 7 years). RSMo §§ 569.095, 569.097, 569.099 |
| Montana | Unlawful use of a computer covers knowingly and without authorization accessing a computer or network without the owner's consent, destroying or disabling a system, introducing malicious code (including code that deletes, encrypts or otherwise makes data or systems unavailable), destroying or taking protected data, using another person's login credentials, or using someone's computer to track or monitor them. If the loss is $1,500 or less (or cannot be measured), the penalty is up to 6 months in county jail and a fine of up to $1,500; above $1,500 it is up to 10 years in prison and a fine of up to 2 1/2 times the value. MCA § 45-6-311(1)-(2) |
| Nebraska | Nebraska's computer crime laws punish accessing a computer without authorization or beyond authorization. Accessing without authority is a Class V misdemeanor (Class II for a repeat). Using such access to obtain or deprive someone of property or services, or to alter, delete or destroy data, disrupt a system, or spread a destructive program, is graded by value: under $500 a Class II misdemeanor, $500 to $1,499 a Class I misdemeanor, $1,500 to $4,999 a Class IV felony (up to 2 years), and $5,000 or more a Class III felony (up to 4 years). Penetrating a computer security system is a Class II misdemeanor if it compromises data, a Class I misdemeanor if it risks public health and safety, and a Class IV felony if it creates a grave risk of death. Neb. Rev. Stat. §§ 28-1343.01, 28-1344, 28-1345, 28-1347 |
| Nevada | Knowingly, willfully and without authorization accessing, changing, damaging or destroying data or programs, or introducing a computer contaminant (such as a virus, worm or Trojan horse), is a misdemeanor; interfering with or denying access to a computer or network, or unauthorized use of a computer system or information service, is a gross misdemeanor. Either becomes a category C felony (1 to 5 years and a fine of up to $100,000, plus restitution) if done to defraud or obtain property, if it causes response costs, loss or damage over $500, or if it interrupts a public service. NRS 205.4737, 205.4765, 205.477 |
| New Hampshire | New Hampshire's computer crimes include unauthorized access to a computer or network, theft of computer services, interrupting or denying computer services, misuse of computer data (unauthorized copying, altering, deleting or intercepting data), destroying computer equipment, and introducing a computer contaminant that causes loss. Computer crime is a misdemeanor if the loss is $1,000 or less, a class B felony (up to 7 years) if it is over $1,000 up to $1,500, if it recklessly risks serious injury, or for theft of services, data misuse or contamination, and a class A felony (up to 15 years) if the loss exceeds $1,500 or for certain repeat offenses. RSA 638:17, 638:18 |
| New Jersey | Computer criminal activity (purposely or knowingly accessing a computer, network or data without authorization or beyond it) is a crime of the third degree (3-5 years). Altering, damaging or destroying data or systems, or disrupting computer services for other users, is second degree (5-10 years). Accessing a computer to defraud or to obtain money, property, services or personal identifying information is third degree, or second degree above $5,000; copying or taking data is third degree, or second degree for personal, medical or legally protected information or data worth over $5,000. Any of these is first degree (10-20 years) if it substantially disrupts public utilities or services, causes over $250,000 in loss, or causes significant bodily injury, and a sentence involving a government victim must include prison. Wrongfully accessing a computer and disclosing data is third degree, or second degree for legally protected information. N.J.S. 2C:20-25; N.J.S. 2C:20-31; N.J.S. 2C:43-6 |
| New Mexico | New Mexico's Computer Crimes Act grades offenses by value. Knowingly accessing a computer, system or network to obtain money or property by embezzlement or fraud, knowingly altering, damaging, disrupting or destroying a computer or computer service without authorization (computer abuse), and accessing, using, copying or taking computer property or services without authorization are each a petty misdemeanor at $250 or less; a misdemeanor over $250 to $500; a fourth degree felony (18 months) over $500 to $2,500; a third degree felony (3 years) over $2,500 to $20,000; and a second degree felony (9 years) over $20,000. Knowingly inserting false data into a computer or database intending to harm another's property or financial interests is a fourth degree felony. NMSA 1978, 30-45-3, 30-45-4, 30-45-5; NMSA 1978, 31-18-15, 31-19-1 |
| New York | Unauthorized use of a computer (knowingly using or accessing a computer, service or network without authorization) is a class A misdemeanor (up to 364 days). Computer trespass (unauthorized access intending to commit a felony, or gaining access to computer material) is a class E felony (up to 4 years). Computer tampering (unauthorized access and intentionally altering or destroying another's data or programs) is a class A misdemeanor in the fourth degree; third degree (class E felony) if done to commit a felony, after a prior conviction, or causing over $1,000 in damage; second degree (class D felony) above $3,000 or when altering medical records causes serious injury; and first degree (class C felony, up to 15 years) above $50,000. N.Y. Penal Law 156.05, 156.10, 156.20, 156.25, 156.26, 156.27; 70.00 |
| North Carolina | Willfully accessing a computer or network to carry out a scheme to defraud or to get property or services by false pretenses is a Class G felony if the fraud or the property obtained exceeds $1,000, and a Class 1 misdemeanor otherwise; other willful, unauthorized access is a Class 1 misdemeanor. Computer trespass (using a computer without authority to delete or disable data, cause malfunctions, alter data, damage property or copy data) is a Class 3 misdemeanor, a Class 1 misdemeanor if it causes damage under $2,500, and a Class I felony if damage is $2,500 or more. A victim may also sue for damages. N.C. Gen. Stat. 14-454, 14-458; 15A-1340.17 |
| North Dakota | Computer crime (intentionally accessing, altering, damaging, copying, disclosing, taking, introducing a computer contaminant into, destroying or blocking authorized use of a computer, system, network, software or data without authorization or beyond it) is a class A misdemeanor (up to 360 days). Computer fraud (doing any of those things without authorization to carry out a scheme to defraud or deceive, block authorized use, or get property or services by false pretenses) is a class C felony (up to 5 years). The owner of the computer may also sue for damages, restitution and attorney fees. N.D.C.C. 12.1-06.1-08; 12.1-32-01 |
| Ohio | Unauthorized use of computer, cable or telecommunication property (knowingly gaining or trying to gain access to any computer, system or network without the owner's consent or beyond it, including by hacking) is a fifth-degree felony (6-12 months). If done to defraud, to obtain money, property or services by false pretenses, or to commit another crime, it is a fourth-degree felony for losses of $7,500 to under $150,000 and a third-degree felony at $150,000 or more; higher grades apply when the victim is elderly or disabled. Unauthorized access to the state law enforcement data systems is also covered. R.C. 2913.04(B), (G); 2929.14 |
| Oklahoma | Under the Oklahoma Computer Crimes Act, hacking that damages, alters, copies, deletes or takes data, using a computer to defraud or extort, exceeding authorized access to cause damage, disrupting computer services, providing a means of unauthorized access, using a computer to put someone in fear of physical harm, and soliciting any of these acts are Class C2 felonies: up to 7 years for a first offense and a fine of $5,000 to $100,000, or both. Simple unauthorized access, unauthorized use of computer services, and using a computer to annoy, abuse, threaten or harass are misdemeanors punishable by up to 30 days in jail, a fine up to $5,000, or both. Victims may also sue for damages. 21 O.S. §§ 1953, 1955; § 20M |
| Oregon | Computer crime is knowingly accessing or using a computer, system or network to defraud, to obtain money, property or services by false pretenses, or to commit theft (including theft of proprietary information or an intimate image), or knowingly and without authorization altering, damaging or destroying a computer, system, software or data; these are Class C felonies (up to 5 years). Simply accessing or using a computer, system or network without authorization is a Class A misdemeanor (up to 364 days). Any violation involving Oregon State Lottery systems is a Class C felony. ORS 164.377 |
| Pennsylvania | Unlawful use of a computer (accessing or exceeding authorization to alter, damage or destroy a system, or to defraud; intentional unauthorized access; or giving out passwords or access codes without authorization), disruption of service such as denial-of-service attacks, computer theft of data, unlawful duplication of data or software, computer trespass and distributing a computer virus are each felonies of the third degree (up to 7 years). Unlawful duplication is raised one grade if the copied material is worth more than $2,500. 18 Pa.C.S. §§ 7611-7616 |
| Rhode Island | Accessing a computer, system or network to defraud or obtain money, property or services by false pretenses, and intentionally accessing, altering, damaging or destroying a computer, software or data without authorization for fraudulent or other illegal purposes, are felonies punishable by up to 5 years, a fine up to $5,000, or both. Computer theft (taking or keeping a computer, software or data without right) is a felony with the same penalty if the value is over $500, and a misdemeanor (up to 1 year, a fine up to $1,000, or both) if $500 or less. R.I. Gen. Laws §§ 11-52-2, 11-52-3, 11-52-4, 11-52-5 |
| South Carolina | It is a computer crime to willfully, knowingly, maliciously and without authorization access a computer to defraud or commit another crime, or to alter, damage or destroy systems, programs or data, or introduce a computer contaminant such as a virus or worm. First-degree computer crime (gain or loss over $10,000) is a felony with up to 5 years, a fine up to $50,000, or both. Second-degree (over $1,000 to $10,000, denial of service for fraud, and similar) is a misdemeanor with up to 1 year and a $10,000 fine for a first offense, up to 2 years and $20,000 for a repeat. Third-degree ($1,000 or less, or unauthorized computer hacking) is a misdemeanor with up to 30 days or a $200 fine for a first offense, up to 2 years and $2,000 for a repeat. S.C. Code §§ 16-16-10, 16-16-20 |
| South Dakota | Unlawful use of a computer system is graded by the conduct. Simply accessing a computer system without the owner's consent is a Class 1 misdemeanor; unauthorized access that reaches confidential data, or copying information, defeating security controls or sharing passwords, is a Class 6 felony; disrupting or denying access to software or data is a Class 5 felony; disrupting access to a system or altering software or data is a Class 4 felony; destroying or disabling a system, software or data is a Class 3 felony (up to 15 years); and using a computer as part of a deception to obtain money, property or services is a Class 2 felony (up to 25 years). SDCL 43-43B-1, 43-43B-3 |
| Tennessee | Knowingly accessing a computer or network to get money, property or services by false pretenses, intentionally altering, damaging or disrupting computers, software or data without authorization, or trafficking in the proceeds, is graded like theft under § 39-14-105 by the value involved. Intentionally accessing a computer system without authorization, introducing a computer contaminant (malicious code), or tampering with security devices is a Class A misdemeanor (up to 11 months, 29 days and a $2,500 fine). Any violation committed in connection with an act of terrorism is a Class A felony (15 to 60 years). The statute does not name ransomware. Tenn. Code Ann. §§ 39-14-602, 39-14-105; § 40-35-111 |
| Texas | Breach of computer security (knowingly accessing a computer, network or system without the owner's consent) is a Class B misdemeanor (up to 180 days and a $2,000 fine), or a state jail felony for a government or critical-infrastructure system or a third conviction. Accessing a computer to defraud, harm or damage property is graded by the amount involved, from a Class C misdemeanor (under $100) to a first-degree felony ($300,000 or more, or obtaining others' identifying information from more than one system). Introducing ransomware or altering data in transit through deception (electronic data tampering) is a Class C misdemeanor, graded up to a first-degree felony by the amount or harm involved, and intentionally interrupting access to a computer system is a third-degree felony. Tex. Penal Code §§ 33.02, 33.022, 33.023; §§ 12.21-12.35 |
| Utah | Accessing a computer without authorization (or exceeding authorization) in a way that alters, damages, copies or discloses data, interferes with use, enables surveillance or causes loss, or carrying out a denial-of-service attack, is graded by loss: class B misdemeanor under $500, class A misdemeanor for $500 to $1,500, third-degree felony for $1,500 to $5,000 or where confidential or identifying information is obtained or a security system is breached, and second-degree felony for $5,000 or more. Using a computer to defraud follows similar value tiers. Interfering with critical infrastructure is a third-degree felony, and simple unauthorized access is a class B misdemeanor. The statutes do not name ransomware. Utah Code §§ 76-6-703, 76-6-703.3, 76-6-703.5, 76-6-703.7 |
| Vermont | Knowingly and intentionally accessing a computer, system, network, software or data without lawful authority carries up to 6 months and/or a $500 fine. Accessing a computer to defraud or obtain money, property or services by false pretenses carries up to 1 year (2 years for a repeat offense) when $500 or less is involved, and up to 10 years and/or $10,000 above $500. Intentionally altering, damaging or interfering with a computer or data, or stealing or destroying computer systems, software or data, carries up to 1 year and/or $5,000 for $500 or less (2 years for a repeat), and up to 10 years and/or $25,000 for more than $500. Victims may sue for damages. The chapter does not name ransomware. 13 V.S.A. §§ 4102, 4103, 4104, 4105, 4106 |
| Virginia | Computer trespass (with malicious intent or deception and without authority, deleting or disabling data, causing a malfunction, altering data, making unauthorized copies, installing keystroke loggers or software to take control of someone's computer) is a Class 1 misdemeanor (up to 12 months and/or $2,500), and a Class 6 felony (1 to 5 years) if it targets government or utility computers, causes $1,000 or more in damage, or hits more than five computers. Computer fraud (using a computer without authority to obtain property by false pretenses, embezzle or steal) is a Class 1 misdemeanor under $1,000 and a Class 5 felony (1 to 10 years) at $1,000 or more. Computer invasion of privacy and theft of computer services are Class 1 misdemeanors, rising to Class 6 felonies in listed cases. The statutes do not name ransomware. Va. Code §§ 18.2-152.3, 18.2-152.4, 18.2-152.5, 18.2-152.6; §§ 18.2-10, 18.2-11 |
| Washington | Intentionally accessing someone's computer system or database without authorization is computer trespass in the second degree, a gross misdemeanor (up to 364 days and/or $5,000); it is first degree, a class C felony (up to 5 years and/or $10,000), if done to commit another crime or if the system belongs to a government agency. Maliciously disrupting access to a data network (such as a denial-of-service attack), introducing malware to defraud, extort or gain control (first-degree electronic data tampering, which covers ransomware-type conduct), and stealing electronic data to defraud are each class C felonies. RCW 9A.90.040, 9A.90.050, 9A.90.060, 9A.90.080, 9A.90.100; RCW 9A.20.021 |
| West Virginia | Accessing a computer to carry out a scheme to defraud or obtain money or property by fraud (computer fraud) is a felony: up to 10 years and/or up to $10,000. Introducing ransomware with intent to extort money is a felony: up to 10 years and/or up to $100,000. Knowingly accessing a computer without authorization to obtain computer services is a misdemeanor ($200 to $1,000 fine and/or up to 1 year). Damaging or destroying computers or data, or introducing a computer contaminant, is a misdemeanor (up to 6 months and/or $1,000) when the loss is up to $1,000 and a felony (up to 10 years and/or $200 to $10,000) above $1,000. Disrupting computer services is a misdemeanor, but disrupting or threatening to disrupt them to obtain money is a felony punishable by up to 20 years and/or up to $1,000,000. W. Va. Code §§ 61-3C-4, 61-3C-5, 61-3C-7, 61-3C-8 |
| Wisconsin | Willfully, knowingly and without authorization modifying, destroying, accessing, taking, copying or disclosing computer data, programs or access codes, or overloading a computer system to interrupt service, is a Class A misdemeanor (up to 9 months and/or $10,000). It becomes a Class I felony (up to 3 years 6 months) if done to defraud or obtain property, and a Class F felony (up to 12 years 6 months) if it causes damage over $2,500, disrupts government operations, public communications, transportation or utilities, or creates a substantial risk of death or great bodily harm. Damaging or taking computers or computer equipment follows a similar scale (Class H felony for damage over $2,500). Penalties may be increased for hiding the identity or location of the computer used, and a judge may restrict the offender's computer use. The statute does not separately name ransomware. Wis. Stat. §§ 943.70(2), (3), (4), 939.50(3), 939.51(3) |
| Wyoming | Knowingly and without authorization accessing a computer or network, or denying service to authorized users (a crime against computer users), is a felony punishable by up to 3 years and/or $3,000, or up to 10 years and/or $10,000 if done to defraud or obtain property. Modifying or destroying data or programs, or taking confidential data worth more than $750, follows the same scale. Sending malware with intent to damage or cause malfunction (computer trespass) is a misdemeanor (up to 6 months and/or $750) if damages are under $10,000, and a felony (up to 10 years and/or $10,000) at $10,000 or more. Introducing ransomware that demands payment to remove it or repair the damage (computer extortion) is a felony punishable by up to 10 years, a fine up to $10,000, or both. W.S. 6-3-502, 6-3-503, 6-3-504, 6-3-506, 6-3-507 |
General legal information, not legal advice. Laws change and local rules can differ; check the linked official source or talk to a lawyer about your situation.