COMPUTER CRIMES
I. INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 442
II. COMPUTER INTRUSION AND FRAUD. . . . . . . . . . . . . . . . . . . . . . . . . 444
A. Botnets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445
B. Spyware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445
C. Ransomware. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446
D. Viruses. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447
E. Worms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447
F. Trojan Horses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447
G. Logic Bombs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448
H. Sniffers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448
I. Denial of Service Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . 448
J. Rootkit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449
K. Spam . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449
L. Phishing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449
III. FEDERAL APPROACHES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450
A. The Computer Fraud and Abuse Act . . . . . . . . . . . . . . . . . . . 450
1. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450
2. Provisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451
3. Penalties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453
4. Proposed Reform . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453
B. First Amendment and Online Speech . . . . . . . . . . . . . . . . . . . 454
1. Threat Speech . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 455
2. Child Pornography and Sexual Communication with
Minors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456
3. Spam. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458
4. Anonymous Speech . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
5. Miscellaneous Exceptions. . . . . . . . . . . . . . . . . . . . . . . . 461
C. Traditional Crime. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461
1. Property Theft . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462
2. Identity Theft. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462
3. Wire Fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464
4. Facilitating Prostitution and Section 230 . . . . . . . . . . . . . 464
D. Fourth Amendment Search and Seizure . . . . . . . . . . . . . . . . . 465
1. Scope and Execution of a Search . . . . . . . . . . . . . . . . . . 467
2. Third-Party Doctrine . . . . . . . . . . . . . . . . . . . . . . . . . . . 470
E. Electronic Surveillance & the Electronic Communications
Privacy Act . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 471
1. Categorization of Information . . . . . . . . . . . . . . . . . . . . . 473
2. Components of the ECPA . . . . . . . . . . . . . . . . . . . . . . . . 475
441
a. Pen/Trap. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475
b. Wiretap Act . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 476
c. Stored Communications Act . . . . . . . . . . . . . . . . . . 478
3. Exceptions and Defenses . . . . . . . . . . . . . . . . . . . . . . . . 480
IV. STATE APPROACHES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
A. Structure of State Criminal Codes . . . . . . . . . . . . . . . . . . . . . 481
B. State Computer Crime Initiatives . . . . . . . . . . . . . . . . . . . . . . 482
1. Online Harassment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 482
2. Spam. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483
3. Unauthorized Access, Hacking, Spyware, and Phishing . . 483
4. Protection of Personal Information . . . . . . . . . . . . . . . . . 483
5. Cyberbullying . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484
6. Jurisdiction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 485
7. Enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 485
V. ENFORCEMENT CHALLENGES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486
A. Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486
B. Extraterritoriality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488
C. International Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
D. Rules of Evidence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490
I. INTRODUCTION
The U.S. Department of Justice (“DOJ”) broadly defines computer crime—also
known as cybercrime—as crime that “use[s] or target[s] computer networks.”
1
U.S. DEP’T OF JUST., PROSECUTING COMPUTER CRIMES (2d ed. 2010) [hereinafter PROSECUTING COMPUTER
CRIMES], http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf; see also Crime, BLACK’S LAW
DICTIONARY (11th ed. 2019) (defining computer crime similarly).
Although cybercrime includes traditional crimes, such as fraud or theft committed using
a computer,
2
it also encompasses unique crimes like hacking.
3
To combat cybercrime,
prosecutors rely on a combination of technology-specific federal legislation—such as
the Computer Fraud and Abuse Act
4
—and traditional criminal law—such as proscrip-
tions against narcotics trafficking and theft—to combat illicit cyberspace activities.
5
Though cybercrime is prosecuted at the state and federal levels, its frequency is
hard to measure.
6
See, e.g., COUNCIL OF ECON. ADVISERS, EXEC. OFF. OF THE PRESIDENT, THE COST OF MALICIOUS CYBER
ACTIVITY TO THE U.S. ECONOMY 30 (2018) [hereinafter THE COST OF MALICIOUS CYBER ACTIVITY], https://
Many never learn they were victims of cybercrime, and commercial
1.
2. See infra Section III.C.
3. See, e.g., 18 U.S.C. §§ 1029–1030, 1037; Stephen Cobb, Advancing Accurate and Objective Cybercrime
Metrics, 10 J. NAT’L SEC. L. & POL’Y 605, 610 (2020) (listing examples of cybercrimes and explaining that
“some computer crimes are unique to computers while others are traditionally prohibited forms of human
misbehavior enhanced by technology”); Neal Kumar Katyal, Criminal Law in Cyberspace, 149 U. PA. L. REV.
1003, 1013 (2001) (describing different types of crimes that occur online or on a computer).
4. See Counterfeit Access Device and Computer Fraud and Abuse Act of 1984, Pub. L. No. 99-474, 100 Stat.
1213 (1986) (codified at 18 U.S.C. § 1030).
5. See, e.g., United States v. Sterlingov, 573 F. Supp. 3d 28, 33 (D.D.C. 2021) (prosecuting money laundering
and other financial crimes committed in cyberspace).
6.
442 AMERICAN CRIMINAL LAW REVIEW [Vol. 61:441
trumpwhitehouse.archives.gov/wp-content/uploads/2018/02/The-Cost-of-Malicious-Cyber-Activity-to-the-U.S.-
Economy.pdf (“[T]he field of cybersecurity is plagued by insufficient data, largely because firms face a strong
disincentive to report negative news.”); cf. Cobb, supra note 3, at 605–06 (arguing that “[e]ven the most affluent
of nations have not yet managed to consistently generate acceptable statistics about any crimes, cyber or non-
cyber,” but this deficiency seems most harmful to “efforts to deter and defeat cybercrime”).
entities and institutions that learn of an intrusion are often reluctant to report the event
due to fear of negative publicity, reduced consumer trust, and increased regulatory
scrutiny.
7
See Lesley Fair, FTC Addresses Uber’s Undisclosed Data Breach in New Proposed Order, FED. TRADE
COMM’N BUS. BLOG (Apr. 12, 2018), https://www.ftc.gov/news-events/blogs/business-blog/2018/04/ftc-
addresses-ubers-undisclosed-data-breach-new-proposed (describing the FTC’s revised consent order against
Uber after Uber failed to disclose its 2016 breach); see also Robert Lemos, Companies Fall Shot on
Mandatory Reporting of Cybercrimes, DARK READING (Jun. 2, 2020), https://www.darkreading.com/attacks-
breaches/companies-fall-short-on-mandatory-reporting-of-cybercrimes/d/d-id/1337977 (citing the ISACA
“State of Cybersecurity 2020” report finding 62% of 2,051 surveyed cybersecurity professionals think their
companies under-report cybercrimes); KENNETH OLMSTED & AARON SMITH, PEW RSCH. CTR., AMERICANS AND
CYBERSECURITY 3–4 (2017), https://www.pewresearch.org/internet/2017/01/26/americans-and-cybersecurity/ (describing
a poll finding only about twelve percent of Americans have a very high level of confidence that government and private
companies can protect their personal information).
Such disincentives to reporting cybercrime, the difficulty of detecting it,
and the dual systems of state and federal prosecution
8
make calculating the total dam-
age and frequency of cybercrime difficult.
9
THE COST OF MALICIOUS CYBER ACTIVITY, supra note 6, at 30; see also Josephine Wolff, The Real
Reasons Why Cybercrimes May Be Vastly Undercounted, SLATE (Feb. 12, 2018), https://slate.com/technology/
2018/02/the-real-reasons-why-cybercrimes-are-vastly-underreported.html (describing why companies may be
reluctant to report accurate numbers regarding cybercrime); cf. Cobb, supra note 3, at 617–18 (outlining
additional challenges in calculating the frequency of cybercrime, including using an outdated conceptualization
and focus on crimes against people rather than commercial organizations in reporting surveys).
The legislative
10
Rebecca Beitsch, Spending bill includes large funding increase to boost cybersecurity, THE HILL (Mar.
11, 2022, 4:30 PM), https://thehill.com/policy/national-security/597902-spending-bill-includes-large-funding-
increase-to-boost-cybersecurity/.
and executive
11
See Press Release, U.S. Dep’t. of Just., Former Chief Security Officer Of Uber Convicted Of Federal
Charges For Covering Up Data Breach Involving Millions Of Uber User Records (Oct. 5, 2022), https://www.
justice.gov/usao-ndca/pr/former-chief-security-officer-uber-convicted-federal-charges-covering-data-breach.
branches
have made recent efforts to improve reporting of cyber incidents, but it is too early to
assess their impact.
Regardless, regular news alerts of compromised consumer accounts
12
See, e.g., Alex Baker-Whitcomb, WhatsApp Was Hacked, Your Computer Was Exposed, and More News,
WIRED (May 14, 2019, 6:41 PM), https://www.wired.com/story/whatsapp-hack-intel-vulnerability-todays-news/;
Erik Ortiz, Marriott says breach of Starwood guest database compromised info up to 500 Million, NBC NEWS
(Nov. 30, 2018, 7:35 PM), https://www.nbcnews.com/tech/security/marriott-says-data-breach-compromised-
info-500-million-guests-n942041.
and recur-
ring threats to U.S. companies and individuals show cybercrime affects daily life
and seriously impacts many victims.
13
See, e.g., Kevin Collier, Four States Warn Unemployment Benefits Applicants About Data Leaks, NBC
NEWS (May 21, 2020, 5:01 PM), https://www.nbcnews.com/tech/security/four-states-warn-unemployment-
benefits-applicants-about-data-leaks-n1212431 (highlighting how states might have exposed their own residents
to identity theft “in their rush to set up websites to provide emergency benefits during the pandemic”); David E.
Sanger & Charlie Savage, U.S. Says Russia Directed Hacks to Influence Elections, N.Y. TIMES (Oct. 7, 2016),
http://www.nytimes.com/2016/10/08/us/politics/us-formally-accuses-russia-of-stealing-dnc-emails.html?_r=0.
In 2019, an academic study found “about
7.
8. See Joseph M. Olivenbaum, Ctrl-Alt-Del: Rethinki ng Federal Computer Crime Legislation, 27 SETON
HALL L. REV. 574–75 n.4 (1997) (arguing the dual system of prosecution renders statistics suspect).
9.
10.
11.
12.
13.
2024] COMPUTER CRIMES 443
