How Should Companies Respond to Computer Fraud Allegations?

Computer fraud involves intentional unauthorized access to a computer system or network to obtain information, cause damage, or facilitate another crime. The definition varies between federal statutes and New York state law, with the federal Computer Fraud and Abuse Act establishing the broadest framework for prosecution.

Federal law prohibits accessing a computer without authorization or exceeding authorized access to obtain information of value or cause damage. New York Penal Law Section 156 covers similar conduct but focuses on state-level enforcement and includes specific provisions for damaging computer systems, altering data, or stealing trade secrets. The intent requirement differs significantly: federal prosecutors must prove intent to defraud or obtain something of value, while state prosecutors may pursue charges based on recklessness or negligence in certain circumstances. Courts have interpreted unauthorized access expansively, sometimes capturing employee conduct that technically violates company policy even when the employee holds legitimate system credentials.

Prosecutors must establish that the defendant acted knowingly and with intent to defraud or obtain something of value, a burden that hinges on circumstantial evidence, system logs, and forensic findings. Direct admissions are rare; instead, prosecutors rely on access patterns, data exfiltration timing, and the defendant's knowledge of authorization boundaries.

Evidence typically includes email communications showing awareness of access restrictions, IT audit logs documenting suspicious queries or downloads, and testimony from system administrators about authorization protocols. Courts recognize that intent can be inferred from conduct, particularly when a defendant accessed systems outside normal job functions, used concealment techniques, or transferred sensitive data to personal devices or external accounts. The challenge for corporate defendants lies in distinguishing between authorized access that exceeded scope and truly unauthorized intrusion. New York courts have held that an employee with legitimate credentials who accesses files outside their job responsibilities may face fraud charges if the access was intentional and the defendant knew the access violated company policy or law, even absent explicit authorization denial.

Corporations may face liability not only for employee misconduct but also for inadequate cybersecurity practices that enable external attacks or facilitate internal theft. Regulatory bodies, civil plaintiffs, and criminal prosecutors increasingly scrutinize organizational security posture as evidence of negligence or recklessness.

Inadequate access controls, failure to implement multi-factor authentication, poor data classification, and insufficient monitoring create vulnerabilities that prosecutors may characterize as negligent enablement of fraud. Civil plaintiffs alleging accounting fraud or data theft often assert that corporate security failures contributed to the harm, exposing the organization to damages beyond direct loss. Regulatory agencies such as the SEC, FTC, and state attorneys general may impose penalties for security negligence independent of criminal charges. The organization's response to known vulnerabilities is critical: courts and regulators evaluate whether the corporation implemented reasonable safeguards, conducted security assessments, and updated controls after discovering gaps.

Corporations should involve counsel immediately upon discovering unauthorized access, suspicious data movement, or evidence of employee misconduct affecting computer systems. Early engagement allows counsel to implement a litigation hold, preserve forensic evidence, and coordinate with law enforcement to avoid procedural missteps.

Delaying counsel engagement risks spoliation of evidence, inadvertent waiver of attorney-client privilege, and loss of strategic control over the investigation narrative. Organizations should avoid self-help forensics or internal investigations that may contaminate evidence or create admissibility problems later. Counsel can advise on notification obligations to customers, regulators, and law enforcement, timing that varies by jurisdiction and industry. The corporation's cooperation with authorities, transparency in forensic findings, and proactive remediation often influence prosecutorial discretion and may reduce criminal exposure for the organization itself, though individual employees may face charges regardless.

Strategic considerations for corporations facing computer fraud allegations should focus on several concrete priorities. First, establish a clear factual record regarding access authorization, policy notice, and the defendant's knowledge of restrictions before any forensic analysis concludes or statements are made to authorities. Second, evaluate whether the organization's cybersecurity practices met industry standards at the time of the incident, as this determination may influence both criminal exposure and civil liability. Third, preserve all communications, training records, and system configurations contemporaneous with the incident, as gaps in documentation often become the defendant's leverage point in challenging the prosecution's timeline or intent theory. Fourth, document the organization's response to the incident, including remediation steps, security upgrades, and employee disciplinary actions, to demonstrate organizational commitment to preventing recurrence. These steps do not guarantee any particular outcome but position the corporation to defend its interests effectively in criminal, civil, and regulatory forums.