Unauthorized Access to a Computer 18 U.S.C. § 1030(a)(2)
18 U.S.C. § 1030(a)(2) is a provision of the Computer Fraud and Abuse Act that specifically addresses unathorized access to computers. This federal law makes it illegal to knowingly access a computer without authorization, or to exceed authorized access, with the intent to obtain information from a protected computer. A “protected computer” is one that is involved in interstate or international commerce, so nearly every computer today is considered a protected computer. Often times, alleged violations of 18 U.S.C. § 1030(a)(2) involves employees using their work computers for personal reasons or accessing information they do not have the authorization to access. However, hacking, accessing someone else’s financial records, and accessing another user’s account are all considered violations of this law.
The Unauthorized Access to a Computer Statute: 18 U.S.C. § 1030(a)(2)
18 U.S.C. § 1030(a)(2) prohibits individuals from intentionally accessing a computer without authorization or exceeding their authorized access, and thereby obtaining:
(A) information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602(n) [1] of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.);
Elements of Unauthorized Access to a Computer
In order to be convicted under 18 U.S.C. 1030(a)(2), the government must prove, beyond a reasonable doubt, that:
- The defendant knowingly accessed a computer;
- The defendant did not have authorization or exceeded authorization; and
- The defendant intended to obtain information from the computer
An essential element of the offense is whether the defendant had authorization to access the computer or whether they exceeded the scope of their authorization. A defense could therefore involve proving that access was authorized or that the defendant was not aware that their actions exceeded the scope of their authorization.
Penalties for Unauthorized Access to a Computer
Possible Defenses to Unauthorized Access to a Computer
- Lack of knowledge: The defendant did not know that their actions were unauthorized
- Authorization: The defendant did in fact have authorization to access the computer or information in question, either explicitely or through implied consent
- Lack of intent to obtain information: The defendant did not access the computer to obtain information or that information retreived was incidental
- Mistake of Fact: The defendant did not understand that they lacked authorization to access the computer, or that they misunderstood the limits of their authorization
