You asked about the penalties under state law for computer hacking (accessing someone's computer without authorization).

SUMMARY

Someone who hacks into another person's computer could be punished by a number of different crimes, depending on the circumstances. The law punishes hacking under the computer crime statutes. These crimes carry penalties ranging from a class B misdemeanor (punishable by up to six months in prison, a fine of up to $1,000, or both) to a class B felony (punishable by up to 20 years in prison, a fine of up to $15,000, or both). The law also punishes unauthorized access to a computer or computer network, with penalties ranging from a class B misdemeanor to a class D felony (punishable by up to five years in prison, a fine of up to $5,000, or both).

A number of generally applicable crimes could also apply. For example, hacking could be done to commit identity theft or larceny and it could be punished under those generally applicable crimes.

In addition to criminal penalties, the law specifically authorizes someone harmed by a computer or unauthorized use crime to bring a civil lawsuit against the perpetrator. These civil actions are in addition to any other grounds for a civil action that the injured party may have.

COMPUTER CRIMES

A person commits a “computer crime” when he or she:

1. accesses a computer system without authorization;

2. accesses or uses a computer system to obtain unauthorized computer services (including computer access, data processing, and data storage);

3. intentionally or recklessly disrupts, degrades, or causes disruption or degradation of computer services or denies or causes denial of computer services to an authorized user; or

4. intentionally or recklessly tampers with, takes, transfers, conceals, alters, or damages any equipment used in a computer system.

It is also a computer crime to misuse computer system data. A person commits this crime by:

1. accessing a computer system to use, disclose, or copy data residing in, communicated by, or produced by a computer system;

2. intentionally or recklessly and without authorization (a) tampering with, damaging, or taking data intended for use by a computer system or (b) intercepting or adding to data residing within a computer system;

3. knowingly receiving or retaining data obtained through misuse of computer system information; or

4. using or disclosing data he or she knows or believes was obtained through misuse of computer system information (CGS § 53a-251).

The punishment for committing one of these computer crimes depends on the damage caused and risk of harm created. Table 1 displays the five degrees of computer crime, the amount of damage or harm required for each, and their penalties.

Table 1: Degrees of Computer Crime and the Requirements for Each Penalty (CGS § 53a-252 et seq.)

By law, the value of property or computer services in a computer crime is (1) their market value; (2) if they are unrecoverable, damaged, or destroyed, the cost of reproducing or replacing them; (3) $250 if their value or damage cannot be satisfactorily ascertained; or (4) $1,500 for private personal data (CGS § 53a-259).

The law allows the court to require someone convicted of a computer crime to pay up to double the amount of the defendant's gain from the crime, instead of paying a fine (CGS § 53a-257).

The law gives Connecticut courts jurisdiction whenever any act in furtherance of a computer crime occurs in this state or any computer system or part of one accessed in a computer crime is located in this state (CGS § 53a-261).

UNAUTHORIZED USE OF COMPUTER OR COMPUTER NETWORK

It is a crime to use a computer or computer network without authority and with the intent to:

1. temporarily or permanently remove, halt, or disable computer data, programs, or software;

2. cause a computer to malfunction;

3. alter or erase computer data, programs, or software;

4. create or alter a financial instrument or an electronic funds transfer;

5. cause physical injury to another's property;

6. make or cause to be made an unauthorized copy of computer data, programs, or software residing in, communicated by, or produced by a computer or computer network; or

7. falsify or forge email information or other routing information in any manner in connection with the transmission of unsolicited bulk email through or into the computer network of an electronic mail service provider or its subscribers.

This crime is a class B misdemeanor but if the person causes over $2,500 in property damage it is a (1) class A misdemeanor if the person acted with reckless disregard for the consequences of his or her actions and (2) class D felony if the person acted maliciously (CGS § 53-451).

TERRORISM

The law makes it a class B felony if a person commits a computer crime or unauthorized use of a computer or computer network with intent to intimidate or coerce the civilian population or a unit of government. When the crime is directed against a public safety agency, the law imposes a five year mandatory minimum sentence (CGS § 53a-301).

OTHER CRIMES

Depending on the circumstances, a person who hacks into another's computer could be punished by a number of generally applicable crimes.

For example, if the hacking is done to take personal identifying information for certain purposes, it could be punishable as identity theft. Penalties for identity theft range from a class D to class B felony, primarily based on the value of property taken through the use of personal identifying information and the victim's age (CGS § 53a-129a).

A person could also hack into a computer to commit larceny. Larceny is intentionally and wrongfully taking, obtaining, or withholding property from an owner in order to appropriate it to himself, herself, or another. The penalties for larceny range from a class C misdemeanor (punishable by up to three months in prison, a fine of up to $500, or both) to a class B felony, primarily based on the value of the property taken (CGS § 53a-118 et seq.).

CIVIL ACTIONS

The law specifically authorizes someone harmed by a computer or unauthorized use crime to bring a civil lawsuit against the perpetrator. These civil actions are in addition to any other grounds for a civil action that the injured party may have.

Computer Crime

Anyone who believes a person has engaged, is engaging, or is about to engage in a computer crime can file a civil action for (1) a temporary or permanent order preventing the activity; (2) restitution; or (3) appointment of a receiver.

A person who suffers a personal injury or damage to his or her business or property can also bring an action for damages. The person can recover actual damages, unjust enrichment, triple damages if the defendant acted wilfully and maliciously, reasonable costs, and reasonable attorney's fees (CGS § 52-570b).

Unauthorized Use

A person whose property or person is injured by unauthorized use of a computer or computer network can bring a civil action to enjoin further violations and to recover actual damages, including lost profits, and the costs of the action (CGS § 53-452). The attorney general can also bring an action (CGS § 53-453).

CR:ro