Gray Hat Hacking, The Ethical Hacker’s Handbook, Third Edition
30
Crime Punishment Example
Acquiring national defense, Fine and/or up to 1 year Hacking into a government
foreign relations, or restricted in prison, up to 10 years in computer to obtain classified
atomic energy information prison if repeat offense. data.
with the intent or reason to
believe that the information
can be used to injure the U.S.
or to the advantage of any
foreign nation.
Obtaining information in Fine and/or up to 1 year Breaking into a computer to
a financial record from a in prison, up to 10 years in obtain another person’s credit
financial institution or a card prison if repeat offense. information.
issuer, or information on a
consumer in a file from a
consumer reporting agency.
Obtaining information from
any department or agency
of the U.S. or protected
computer involved in
interstate and foreign
communication.
Affecting a computer Fine and/or up to 1 year Makes it a federal crime
exclusively for the use of a in prison, up to 10 years in to violate the integrity of a
U.S. government department prison if repeat offense. system, even if information is
or agency or, if it is not not gathered. One example is
exclusive, one used for the carrying out denial-of-service
government where the attacks against government
offense adversely affects agencies.
the use of the government’s
operation of the computer.
Furthering a fraud by Fine and/or up to 5 years Breaking into a powerful
accessing a federal interest in prison, up to 10 years in system and using its processing
computer and obtaining prison if repeat offense. power to run a password-
anything of value, unless the cracking application.
fraud and the thing obtained
consists only of the use of the
computer and the use is not
more than $5,000 in a one-
year period.
Table 2-2 Computer Fraud and Abuse Act Laws
The term “protected computer,” as commonly put forth in the CFAA, means a com-
puter used by the U.S. government, financial institutions, or any system used in inter-
state or foreign commerce or communications. The CFAA is the most widely referenced
statute in the prosecution of many types of computer crimes. A casual reading of the