Go to integrated search

Cyber Crime Legal Advice for Online Harassment Investigations

Practice Area:Criminal Law
Jurisdiction:California


Cyber crime legal advice explains when online messages may constitute harassment, stalking, or criminal threats under California law.

An online harassment investigation does not establish criminal liability. California Penal Code §§ 653m, 646.9, and 422 impose different requirements. The messages, contact history, sender's intent, and surrounding circumstances determine which offenses investigators may consider and what prosecutors must prove.



1. Which Criminal Law Applies to Online Harassment Allegations?


California law distinguishes harassing communications, stalking, and criminal threats. Each offense requires different conduct and intent. Identifying the applicable statute helps determine whether reported messages could support criminal charges.


Electronic Harassment under Penal Code § 653m

Section 653m(a) prohibits electronic contact made with intent to annoy that addresses qualifying obscene language to or about another person or threatens injury to that person, certain family members, or their property.

Section 653m(b) prohibits repeated electronic contacts made with intent to annoy or harass, even without a response. Both provisions exclude good-faith communications. Subdivision (b) also excludes contacts made during ordinary business activities.

Offensive language alone does not necessarily establish a violation.

Stalking and Criminal Threats under §§ 646.9 and 422

Section 646.9 addresses willful and malicious harassment or repeated following accompanied by a credible threat intended to cause reasonable fear for safety. The threat must involve an apparent ability to carry it out. The 2026 law also includes qualifying threats involving a person's pet, service animal, emotional support animal, or horse.

Section 422 addresses threats to commit crimes resulting in death or great bodily injury. The statement must convey a serious intention and immediate prospect of execution, causing reasonable, sustained fear. The speaker need not actually intend to carry out the threat.

A single message may support § 422 without establishing stalking. These distinctions are relevant when assessing cyber harassment allegations.


2. When Does Repeated Contact Become Criminal Harassment?


Repetition matters when a statute requires multiple contacts or a course of conduct. Investigators must assess the frequency, purpose, and context rather than treating every unwanted exchange as criminal.


Single Messages Versus Repeated Communications

One qualifying communication may violate § 653m(a), while § 653m(b) requires repeated contact.

Stalking under § 646.9 requires willful and malicious harassment or repeated following, together with a credible threat. Statutory harassment involves a knowing and willful course of conduct directed at a specific person that seriously alarms, annoys, torments, or terrorizes the person and serves no legitimate purpose. The course of conduct must involve at least two acts showing continuity of purpose. Constitutionally protected conduct is excluded.

Repeated arguments alone do not establish stalking.

Contact after a Request to Stop

Messages sent after a request to stop may help establish that continued contact was unwanted and support an inference about the sender's intent.

However, such a request is not an element of every harassment offense. Its absence does not automatically defeat a charge.

A legitimate dispute may explain continued communication but does not excuse independently unlawful threats.


3. How Do Intent and Message Context Affect Criminal Liability?


Prosecutors must establish the mental state required by the charged offense. Offensive wording or the recipient's interpretation alone does not prove criminal intent.


Intent to Annoy, Harass, or Threaten

Section 653m requires the intent specified in the applicable subdivision. Section 422 requires intent that a statement be understood as a threat, not intent to carry it out.

Stalking requires willful and malicious conduct and a credible threat. For indirectly communicated threats, the applicable standard also addresses conscious disregard of a substantial risk that the target would perceive threatened harm and whether the target's awareness was reasonably foreseeable.

Anger or criticism alone does not establish these elements.

Recipient Fear and the Context of a Threat

Section 422 requires actual, reasonable fear lasting beyond a momentary reaction. Its threat must convey a serious prospect of execution, although immediate ability to carry it out is unnecessary.

Stalking uses a separate credible-threat standard involving reasonable fear and apparent ability to carry out the threat.

Investigators examine the words, prior interactions, related conduct, and surrounding circumstances. Conditional statements do not automatically fall outside criminal law. These factors are also relevant to criminal threats allegations.


4. What Can Digital Evidence Prove in an Online Harassment Case?


Digital records may help establish authorship, message content, and conduct relevant to a criminal allegation. Screenshots and account records must be evaluated alongside the broader communication history.


Matching Message History to Criminal Elements

Evidence review should address:

  • Wording: Whether the communication contains prohibited language or a qualifying threat.
  • Authorship: Whether account and device records connect the accused person to the message.
  • Sequence: Whether communications establish repeated contact or a continuing course of conduct.
  • Intent: Whether surrounding exchanges support the required mental state.
  • Fear: Whether the evidence supports reasonable fear where required.

Screenshots may omit context, and account ownership alone may not prove authorship. Prosecutors must establish the elements of the offense beyond a reasonable doubt using admissible evidence.

Distinguishing Harassment from Unauthorized Access

Electronic harassment concerns communications or threatening conduct. Unauthorized access involves distinct conduct affecting computer systems or accounts.

California Penal Code § 502 and the federal Computer Fraud and Abuse Act impose separate requirements. Sending unwanted messages does not itself establish unauthorized access.


5. What Should Someone Review during a Cybercrime Investigation?


Diagram: A vertical process flow detailing steps to identify the allegation and authority, respond to requests, and preserve communications.
Diagram: A vertical process flow detailing steps to identify the allegation and authority, respond to requests, and preserve communications.

A complaint does not establish an offense. Anyone contacted during an investigation should identify the allegation, investigating authority, and legal nature of the request before responding.


Identify the Allegation and Investigating Authority

Local authorities may investigate California harassment or threat offenses. Federal investigators may examine conduct involving a separate federal crime.

An Internet Crime Complaint Center (IC3) report does not itself establish charges or guarantee an investigation.

The suspected offense and applicable jurisdiction determine which legal requirements govern.

Responding to Interview Requests and Contact Restrictions

Police interview requests may be voluntary, while subpoenas, warrants, and court orders impose different obligations.

Before making statements or providing records, a person should clarify the request and consider advice from a criminal defense attorney. Fifth Amendment protections may apply to compelled self-incrimination.

Preserve existing communications without alteration and comply with applicable court-imposed contact restrictions. Related harassment charges may involve additional procedural requirements.


6. Frequently Asked Questions


Can Deleted Online Messages Still Be Used as Criminal Evidence?

Deleted messages may remain available through recipient copies, backups, or lawfully obtained platform records. Admissibility depends on authentication and applicable evidence rules. Deletion does not necessarily prevent their use in a criminal case.

Does an Anonymous Account Prevent Criminal Liability? Anonymity does not automatically prevent prosecution. Prosecutors must establish a sufficient connection between the accused person and the communications through evidence such as account records, device information, or admissions. Constitutionally protected anonymous speech remains distinct from criminal conduct.


05 Nov, 2026


The information provided in this article is for general informational purposes only and does not constitute legal advice. Prior results do not guarantee a similar outcome. Reading or relying on the contents of this article does not create an attorney-client relationship with our firm. For advice regarding your specific situation, please consult a qualified attorney licensed in your jurisdiction.
Certain informational content on this website may utilize technology-assisted drafting tools and is subject to attorney review.

Online Consultation
Phone Consultation