he Computer Fraud and Abuse Act (the “CFAA”) prohibits a person from “knowingly caus[ing] the transmission of a program, information code, or command, and as a result of such conduct, intentionally causes damages without authorization to a protected computer” (see 18 U.S.C. § 1030(a)(5)(A)). While broadly worded, DDoS can be classified as transmission of a “program, information code, or command”. Damage is defined as “any impairment to the integrity or availability of data, a program, a system, or information” under 18 U.S.C. § 1030(e)(8).
Under the guidelines of the law, those found guilty can face up to 20 years in prison. The law stipulates different sentencing structures, each depending on the severity of the attack as well as the intended target. Attacks against government websites and financial institutions face the harshest penalties, especially where national security is concerned.
