UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 7.3 Free with a free account
What Happens When Hackers Get Caught: Criminal Charges, Penalties, and Landmark Cases
Ethics in Technology · Chapter 7: Hackers, Cyber Warfare, and the Global Battle for Digital SecuritySection 7.3 · lesson 30 of 11616 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Politically Motivated Digital Attacks Designed to Create Fear and Disrupt Societies →← Who Hackers Are, What Motivates Them, and How the Practice Has Changed Over TimeNext lesson: Politically Motivated Digital Attacks Designed to Create Fear and Disrupt Societies →
In this lesson
Charges, sentencing, landmark cases, and cross-border proceedings.
- Explain the CFAA’s scope and authorization concepts
- Distinguish maximum penalties from actual sentences
- Compare Morris, Mitnick, Swartz, and Van Buren
- Identify extradition requirements and reform debates
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,888 words). Read along, or search it.
Chapter 7
When Intruders Face the Law
Discovery of an intrusion begins a legal process, rather than deciding its outcome. Authorities investigate, charge offenses, negotiate pleas, or proceed to trial. A court then determines consequences after a conviction, subject to law and the case's facts. Cross-border cases add jurisdiction and surrender questions. This lesson examines the federal computer-access statute, including criminal and civil provisions. We distinguish access without permission from access beyond permitted areas. We compare statutory ceilings with guideline ranges, sentences, restitution, and supervision. Four cases illustrate legal interpretation and public debate. We then trace extradition and the barriers that can arise under different countries' laws. Finally, we evaluate arguments about broad liability, charging pressure, research, and meaningful protection of victims. Keep the offense elements, historical version, evidence, and procedural stage separate throughout that analysis.
Federal Framework
The CFAA Prohibits Specific Conduct Under Specific Conditions
The Computer Fraud and Abuse Act expanded the federal computer-crime framework in nineteen eighty-six. Amendments broadened coverage, adding a qualified civil remedy in nineteen ninety-four. A protected computer can include qualifying government, financial, commerce-connected, and voting-system computers. Nearly all internet-connected machines can qualify, including certain foreign computers affecting American commerce or communication. That broad definition does not prove liability; each charged provision has its own required elements. Categories address national-security information, unlawful information access, and qualifying government-computer trespass. Other provisions address fraud, damage, password trafficking, and computer-related extortion. The fraud provision requires knowing conduct, intent to defraud, and obtaining value under specified conditions. Damage provisions distinguish intentional transmission causing intentional damage, reckless damage, and damage with loss after unauthorized access. Password trafficking also requires relevant knowledge, fraudulent intent, and a specified commerce or government connection. These categories provide a map, rather than automatically covering every computer-related wrong.
Authorization
Entering an Off-Limits Area Differs From Misusing Permitted Information
Access without authorization concerns entry into a system without permission to enter it. Exceeding authorized access concerns a permitted user obtaining information from areas outside their authorization. For example, a user permitted one account may obtain information from a different, prohibited account. Those questions differ from using permitted information for a purpose the employer disapproves of. In twenty twenty-one, Van Buren rejected treating an improper purpose alone as exceeding authorized access. The relevant question was whether the defendant was entitled to retrieve the information he obtained. This narrows the access offense, without approving misconduct or abandoning other duties. Policy breaches can have contractual, employment, professional, or separate legal consequences. Van Buren did not resolve every dispute about access without authorization, including its difficult boundary cases. Nor did it decide whether every possible access limitation must be enforced through a technological barrier. Separate system coverage, permitted areas, purpose, and the other offense elements before reaching a legal conclusion.
Statutory Ceilings
The Offense, Aggravation, Prior Convictions, and Harm Change the Maximum
A statutory maximum is a legislative ceiling, rather than the expected sentence. Some ordinary first information-access and password-trafficking offenses have a one-year imprisonment ceiling. Specified aggravators can raise a first information-access offense's ceiling to five years. A first qualifying intentional-damage offense with listed harm can have a ten-year ceiling. Specified repeat damage offenses can carry twenty years, while special death-related conditions can permit life imprisonment. These examples omit details, and are not a complete penalty schedule. The precise subsection, aggravating conditions, prior convictions, and resulting harm must be identified. A news headline saying someone faces ninety-five years may simply add ceilings across charged counts. It does not prove guilt, require consecutive terms, or predict the sentence. Multiple-count rules, the applicable guideline range, plea terms, and statutory limits affect the eventual calculation. Do not promise that every sentence will be a small fraction, either.
Sentencing
A Court Evaluates Facts, Guidelines, Statutory Limits, and Relevant Factors
Federal guidelines provide an advisory range, considering offense characteristics, qualifying loss, adjustments, and criminal history. The court also applies statutory limits and sentencing factors, rather than a headline total. Applicable grouping and concurrent-sentence rules can prevent simply multiplying punishment by the number of counts. Consecutive terms remain possible, and can be required or needed under particular rules and circumstances. A plea can change charges or recommendations, without guaranteeing a particular outcome. Qualifying loss can include reasonable response costs, damage assessment, restoration, and losses from service interruption. Reasonableness matters; victims cannot control punishment by spending any amount afterward. Courts evaluate evidence and legal standards, while disagreements about appropriate response costs can remain substantial. Similar technical harm can produce different losses, depending on consequences and reasonable response needs. Restitution compensates qualifying victims, while fines and supervised-release conditions can add separate consequences. Computer-use restrictions can affect a technical career, and must be considered under the applicable legal requirements.
United States v. Morris
Unintended Damage Did Not Defeat Liability Under the Earlier Statute
In November nineteen eighty-eight, Robert Tappan Morris released a self-replicating program onto the research internet. The worm spread and multiplied unexpectedly, disrupting networked computers at educational and other institutions. He became the first person convicted under the Computer Fraud and Abuse Act. His sentence included probation, community service, a fine, and supervision costs, rather than imprisonment. On appeal, Morris disputed whether prosecutors had to prove intent to cause the resulting damage. The appeals court held that the earlier provision's intent requirement attached to unauthorized access. It did not require a further intent to prevent authorized use and cause the resulting loss. The court also upheld the finding that his separate access to affected systems was unauthorized. His university account did not authorize entering other computers reached by the worm. Later amendments created separate damage provisions with different mental-state requirements, so the historical version matters. The lesson is careful statutory analysis, rather than claiming all modern damage offenses require only intent to access.
Kevin Mitnick
Custody and Post-Release Restrictions Can Shape the Practical Penalty
Kevin Mitnick's nineteen ninety-five arrest became a highly visible computer-crime case, after an extended pursuit. The prosecution involved access and fraud-related conduct, amid controversy about seriousness and treatment. He pleaded guilty in nineteen ninety-nine to charges including wire fraud and computer-related offenses. The case resulted in imprisonment measured in years, rather than only a financial penalty. Its history also highlights persuasion and misuse of human trust, alongside technical weaknesses. Post-release conditions restricted computer and communications equipment, showing that practical consequences can continue after custody. Such restrictions can strongly affect employment and ordinary participation in a society organized around computers. Courts must assess applicable legal requirements, justification, and the person's circumstances when imposing supervision conditions. Mitnick later worked as a security consultant, raising further questions about rehabilitation and legitimate use of skills. Notoriety alone does not establish actual harm; separate allegations, proven conduct, loss, and the court's decisions. The case illustrates proportionality, evidence, and opportunities for responsible work after punishment.
Aaron Swartz
The Prosecution Intensified Debate About Breadth and Charging Leverage
Aaron Swartz was a programmer and open-access advocate whose case intensified criticism of charging practices. He downloaded a large volume of JSTOR articles through MIT's network during twenty ten and eleven. The government's allegations involved restricted access, efforts to bypass blocking, and effects on service availability. No trial verdict resolved those allegations, so do not present them as proven. JSTOR entered a civil settlement and stated that it did not want to press charges. Federal prosecutors nevertheless brought multiple charges, with authority separate from the settlement. Aggregate statutory ceilings attracted attention, while critics questioned breadth, proportionality, and pressure in plea negotiation. Swartz died by suicide in January twenty thirteen, at twenty-six, before the case went to trial. Aaron's Law proposals sought narrower access definitions and changes concerning the aggregation of counts. The proposals were introduced but not enacted; later judicial interpretation narrowed a separate access issue. Permission to read some material does not alone resolve disputed bulk conduct, and accusations do not establish guilt.
Van Buren Worked Example
An Improper Reason Was Not the Same as Accessing Prohibited Information
Nathan Van Buren was a police officer who accepted payment to look up license-plate information. He could use the database to retrieve that information, but his reason for doing so was improper. The government argued that this improper purpose meant he exceeded authorized access under the computer statute. In twenty twenty-one, the Supreme Court rejected that theory of the access provision. Its focus was on obtaining information from areas, such as accounts or databases, that were off limits. The parties agreed that Van Buren could retrieve the information, despite his unauthorized purpose for retrieving it. The Court described a gates-up-or-down inquiry, rather than criminalizing every violation of a use policy. It left open whether some access restrictions could come from contracts or policies, instead of only technical controls. Other laws and professional duties can address misconduct, so the decision did not endorse selling official information. For practice, contrast using a permitted record for a forbidden purpose with accessing another prohibited account. Identify the permission boundary first, then consider purpose and any separate offense or duty.
Extradition Process
A Cross-Border Charge Does Not Automatically Produce Surrender
A person in one country can affect computers abroad, creating potential competing claims to prosecution. Jurisdiction over conduct differs from being able to obtain custody of the suspect. Extradition is a legal process in which one country requests another to surrender a wanted person. Authorities identify the applicable treaty or other permitted basis, charges, jurisdiction, and required supporting documents. The requested country's court evaluates the request under its law and applicable extradition conditions. An executive authority may then decide whether to surrender the person, depending on the country's procedures. Available appeals and legal impediments must be addressed before authorities complete a custody transfer. The usual United States framework is treaty based, with limited exceptions, while other countries' arrangements can differ. Extradition review is not simply a complete trial deciding guilt on the charged offense. A court's finding that surrender is legally available may still be distinct from the later surrender decision. Describe the countries, governing rules, procedural stage, and possible challenges before predicting an outcome.
Cross-Border Obstacles
Conduct, Nationality, Rights, and Health Can Affect the Request
Dual criminality generally asks whether the alleged conduct is criminal under both states' applicable rules. Offense names need not match; coverage and penalty conditions depend on the arrangement. Older treaties listing offenses can raise different questions from modern treaties defined around criminal conduct. Nationality and territory also matter, because countries differ in surrendering citizens and considering domestic prosecution. Relevant human-rights obligations and detention concerns can limit surrender, with the applicable tests differing by jurisdiction. Health and personal circumstances may affect the decision under the requested country's law. In October twenty twelve, the United Kingdom withdrew Gary McKinnon's extradition order on human-rights grounds. The stated concern involved serious illness and a high risk of suicide if extradited. That historical decision left possible domestic prosecution for separate consideration, rather than deciding innocence at trial. Proceedings can take months or years, and refusal does not guarantee prosecution elsewhere. Arrests during lawful travel in third countries can raise further cooperation questions, without settling the underlying guilt.
Criticism and Reform
Meaningful Protection Must Be Balanced With Clear, Proportionate Rules
Critics question the statute's breadth, uncertain access boundaries, and the leverage created by many charged counts. Broad coverage makes precise offense elements important, rather than letting every dispute turn into a federal computer crime. High aggregate ceilings can shape plea pressure, even when they poorly predict the eventual sentence. Researchers also worry that uncertainty can discourage reporting, testing, and the discovery of weaknesses. The Justice Department's policy declines qualifying good-faith security research, while excluding bad-faith conduct such as extortion. Policy protection differs from statutory immunity and owner permission, and prosecution policies can change. The case for enforcement emphasizes severe remote harm, stolen information, disrupted systems, and difficulties in attribution. Reform debate asks whether rules are clear, proportionate, protective, and suited to present conditions. For review, distinguish access boundaries from purposes, and statutory ceilings from the court's actual sentencing calculation. Explain why reasonable response costs differ from unchecked spending, and why Morris requires historical qualification. Finally, separate an extradition refusal from a trial verdict. Each distinction prevents an overbroad legal conclusion.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About What Happens When Hackers Get Caught: Criminal Charges, Penalties, and Landmark Cases
What is the Computer Fraud and Abuse Act?
What did the Supreme Court decide in Van Buren v. United States?
What penalties can someone face for hacking under the CFAA?
Who was the first person convicted under the Computer Fraud and Abuse Act?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →