How to Find Computer Crime Laws by State: Statutes and CFAA Overlap

To find the computer crime laws by state that apply to your situation, start with the National Conference of State Legislatures’ computer crime statutes page, which lists citations for every state, Puerto Rico, and the U.S. Virgin Islands, organized by the type of conduct at issue.¹ Take the citation for your state and pull the full text from your legislature’s website or a free codes database like Justia. The rest of this guide walks through the specific tools, the search terms that actually work, the categories your state’s law probably covers, and how state statutes interact with the federal Computer Fraud and Abuse Act.

Three Free Resources That Get You to the Statute

The NCSL tracker is the fastest starting point because it does the hardest part of the work for you: identifying which section of your state’s code addresses the specific conduct you’re researching. The tables cover unauthorized access, malware, ransomware, denial-of-service attacks, phishing, and spyware, and they link out to each state’s statutory text.¹

Once you have the citation, Congress.gov keeps a complete directory of every state legislature’s website, which is the authoritative place to read the current text.² Most legislature sites let you search by statute number or keyword. If your state’s site is hard to navigate, Justia publishes the codified statutes for all 50 states and U.S. territories at law.justia.com/codes in a cleaner, more searchable format.

Your state attorney general’s office is a useful supplement. Many publish plain-language guides to their state’s cybercrime laws and instructions for filing complaints, and some run dedicated cybercrime units that investigate identity theft, online fraud, and data breaches. These pages won’t replace reading the statute, but they help you understand how the law is enforced in practice.

Search Terms That Work

State legislatures don’t share a vocabulary. If “computer crime” returns nothing, try “computer fraud,” “unauthorized access,” “computer trespass,” “cybercrime,” or “electronic data tampering.” Some states place these offenses inside broader criminal code chapters rather than a standalone computer crimes section, so widen your search to the general criminal statutes if a targeted search comes up empty.

What State Computer Crime Laws Typically Cover

All 50 states, Puerto Rico, and the U.S. Virgin Islands have enacted computer crime laws.¹ Definitions, offense grades, and penalties differ significantly, but the prohibited conduct tends to fall into recognizable categories. Knowing which category your situation falls into makes the NCSL tables much easier to use.

Unauthorized access, sometimes called computer trespass or hacking, is the most universal category and criminalizes accessing a system or network without permission.
Malware and virus statutes prohibit transmitting programs designed to damage, destroy, or record information inside a computer system without the owner’s consent.
Ransomware laws, now on the books in a growing number of states, target software that locks a victim out of their own system and demands payment for restored access. Some states require victims to report ransomware incidents to law enforcement.
Computer fraud provisions cover using a computer to deceive someone for financial gain, such as manipulating financial records or moving funds with stolen credentials.
Phishing statutes in several states address fake websites and deceptive messages designed to extract passwords, account numbers, or other sensitive information.
Spyware laws prohibit software that secretly tracks online activity, collects personal information, or forces unwanted advertising onto a user’s computer.
Denial-of-service laws cover deliberately flooding a server or network with traffic to shut it down for legitimate users.
Cyberstalking and electronic harassment provisions extend traditional stalking and harassment laws to conduct carried out through electronic communications, or exist as standalone statutes.

The NCSL page provides citation tables for each of these categories, so you can go straight to the relevant section of your state’s code once you know what you’re looking for.¹

How State Laws Overlap With the Federal CFAA

Alongside state law, the main federal computer crime statute is the Computer Fraud and Abuse Act at 18 U.S.C. § 1030. It reaches offenses from accessing government computers for classified information down to trafficking in passwords, and its definitions have shaped how many states drafted their own statutes.³ So state research often runs into federal law whether you planned for it or not.

Computer crimes can be prosecuted under state law, federal law, or both. State prosecutors generally handle cases where the offender and victim are in the same state and no federal system was targeted. Federal jurisdiction kicks in when the conduct crosses state lines, targets a federal government computer, or affects interstate commerce. Because virtually any internet-connected computer qualifies as a “protected computer” under the CFAA, federal prosecutors have wide discretion to take cases they consider significant.³

In practice, federal agencies focus their resources on large-scale attacks, crimes involving financial institutions, threats to critical infrastructure, and cases with national security implications. Smaller-scale offenses usually stay with state prosecutors, though state attorneys general sometimes coordinate with the FBI or the Department of Justice on complex investigations.⁴ The penalty exposure is not equivalent. Federal convictions for computer fraud can carry up to 10 years in prison on a first offense and 20 on a second, while state penalties run from misdemeanors to serious felonies depending on the jurisdiction and severity of the conduct.⁵

One more federal statute is worth knowing about when your research involves email, cloud storage, or messaging platforms: the Stored Communications Act at 18 U.S.C. § 2701. It prohibits intentionally accessing a facility that provides electronic communication services without authorization, or exceeding authorized access, to obtain, alter, or block stored communications. A first offense carries up to one year in prison in most situations, rising to five years for access committed for commercial gain, malicious destruction, or in furtherance of another crime.⁶

If You’re Researching Because of a Data Breach

Breach notification is a separate body of law from the computer crime statutes, but the search process is the same. All 50 states, the District of Columbia, and U.S. territories require businesses and often government entities to notify individuals when their personal information is compromised in a security breach. The NCSL maintains a parallel 50-state tracker for these laws that works the same way as its computer crime page.⁷

The details vary. Roughly 20 states set specific numeric deadlines for notifying consumers, ranging from 30 to 60 days after discovery; the rest require notification “without unreasonable delay.” A majority also require the breached entity to notify the state attorney general or another agency. The categories of data that trigger notification differ too: about half of states explicitly cover biometric identifiers, roughly the same number cover medical information, and only a small minority extend coverage to paper records. At the federal level, financial institutions covered by the FTC’s Safeguards Rule must notify the FTC within 30 days of discovering a breach affecting at least 500 consumers.⁸

Reporting a Computer Crime

If you’re a victim rather than a researcher, the FBI’s Internet Crime Complaint Center is the main federal intake point for cybercrimes and cyber-enabled fraud. File at ic3.gov even if you’re unsure whether your situation qualifies.⁹ The Department of Justice also maintains a resource page for reporting computer and internet-related crimes to local federal law enforcement offices.¹⁰

At the state level, your attorney general’s office typically accepts complaints about cybercrime, identity theft, and online fraud through an online complaint form. Local police can take reports too, though smaller departments often refer complex computer crime cases to state or federal agencies. Filing with more than one agency is usually worthwhile: agencies share information, and a police report or IC3 filing on record can matter later if you need to dispute fraudulent charges or prove that a crime occurred.

When to Bring in an Attorney

Reading the statutes yourself gives you a solid foundation, but computer crime cases turn on technical details and legal nuance the text alone won’t resolve. Authorization disputes often depend on facts that aren’t visible in the statute. Which sovereign takes the case can shift depending on who picks it up first. And the consequences of even a misdemeanor conviction can extend to professional licenses, security clearances, and employment.

If you’re facing potential charges, under investigation, or considering a civil lawsuit under the CFAA, consult a criminal defense or technology law attorney. Hourly rates for complex computer crime work typically range from $200 to $500, though they vary by region and experience, and many attorneys offer an initial consultation at a reduced rate or free of charge. Your state bar association’s lawyer referral service can point you to someone with relevant experience.

1
National Conference of State Legislatures. Computer Crime Statutes
2
Congress.gov. State Legislature Websites
3
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
4
National Association of Attorneys General. Cybercrimes
5
Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers
6
Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
7
National Conference of State Legislatures. Security Breach Notification Laws
8
Federal Trade Commission. Safeguards Rule Notification Requirement Now in Effect
9
Internet Crime Complaint Center. IC3 Home Page
10
United States Department of Justice. Reporting Computer, Internet-Related, or Intellectual Property Crime