Computer Crime Statutes

"Unauthorized access" entails approaching, trespassing within, communicating with, storing data in, retrieving data from, or otherwise intercepting and changing computer resources without consent. These laws relate to these and other actions that interfere with computers, systems, programs or networks.

Malware and viruses (viruses are a type of malware) are a set of computer instructions that are designed to modify, damage, destroy, record, or transmit information within a computer system or network without the permission of the owner. Generally, they are designed to infect other computer programs or computer data, consume resources, modify, destroy, record or transmit data, and disrupt normal operation of a computer system.

In a denial-of-service attack, an attacker floods the bandwidth or resources of a targeted system or servers with traffic, thereby preventing legitimate users from accessing information or services. In a distributed denial of service attack, the attacker compromises and takes control of multiple computers with security flaws and uses them to launch the denial-of-service attack.

At least 26 states have laws that directly address denial of service attacks.

As of Dec. 13, 2021

Ransomware is computer malware that is installed covertly on a victim's computer and preventing access to it, followed by demands for a ransom payment in exchange for returning access or not publishing or exposing data held on the computer.

At least 11 states, listed below, expressly address “ransomware” and/or computer extortion in statute. Most of these states criminalize ransomware and provide for specific penalties. Indiana, Louisiana and North Dakota require public entities to report ransomware incidents. Texas authorizes the Texas Department of Transportation to purchase insurance coverage for ransomware. North Carolina prohibits state agencies and local entities from making ransomware payments,

In addition to laws that expressly mention ransomware or computer extortion, additional states, like North Carolina (NCGA § 143B-1379), require reporting of cyber incidents generally (which may include ransomware attacks) or state IT departments may require agencies to report cyber incidents to a CISO or other official. Also, other types of laws (e.g., that prohibit extortion and computer crimes such as malware or computer trespass) could also potentially be used to prosecute ransomware crimes. 

As of April 16, 2021

Phishing is a scam where fraudsters send spam or text messages or create deceptive websites to lure personal or financial information from unsuspecting victims. The messages or websites often appear to be from well-known or seemingly trustworthy entities, but instead collect information for fraudulent purposes. Twenty-three states and Guam have laws specifically aimed at phishing schemes. Other states have laws that address computer crime, fraudulent or deceptive practices or identity theft, which could also apply to phishing crimes.

For practical tips from the federal government and private industry to help guard against Internet fraud, see OnGuardOnline.gov's information about phishing. 

As of Aug. 24, 2021

Spyware, also sometimes called adware, is software that can track or collect the online activities or personal information of Web users, change settings on users’ computers, or cause advertising messages to pop up on users' computer screens. Web users are often unaware that spyware has been downloaded to their computers.

Twenty-one states, Guam and Puerto Rico have laws expressly targeting spyware. Other states have laws that address computer crime, fraudulent or deceptive practices or identity theft and that possibly could apply to some practices involving spyware.