Florida Computer Crimes Act: Offenses, Penalties, Civil Liability

The Florida Computer Crimes Act, found in Chapter 815 of the Florida Statutes, makes most unauthorized computer access a felony. A baseline violation is a third-degree felony punishable by up to five years in prison, and the charge climbs to a second- or first-degree felony when the conduct involves fraud, causes at least $5,000 in damage, disrupts a public service, or endangers human life. The Act also creates separate offenses for stealing or destroying data, attacking public utility systems, and deploying ransomware against government networks.

What the Act Criminalizes

Chapter 815 sweeps in a wide range of conduct because it defines its terms broadly. A “computer” is any internally programmed device that processes data. An “electronic device” covers smartphones, tablets, and anything that communicates across a network. A “computer contaminant” includes viruses, worms, and any code designed to damage a system or transmit information without permission. If a programmable, networked device is involved, the Act almost certainly applies.

The statute is organized around four offense categories:

Unauthorized access to computers, networks, and electronic devices under Section 815.06.
Offenses against intellectual property (tampering with, destroying, or stealing data and programs) under Section 815.04.
Attacks on public utility computer systems under Section 815.061.
Ransomware attacks on government entities under Section 815.062.

Section 815.06 is the provision most people think of as computer hacking. It prohibits knowingly accessing a system without authorization, disrupting data transmission, damaging equipment, introducing a contaminant, and remotely activating a device’s built-in camera or microphone to conduct surveillance.¹ It reaches insider misuse as well. An employee with legitimate login credentials who uses them to view files outside the scope of their job can be charged; the statute doesn’t require breaking through a password screen.

Section 815.04 targets what happens to the information itself rather than how it was reached. Introducing a contaminant, modifying or destroying data, or disclosing trade secrets or legally confidential information stored on a computer system all fall within it.²

Sections 815.061 and 815.062 carve out heightened offenses for high-stakes targets. The first covers unauthorized access to water treatment, power, and gas utility systems and any commands that disrupt service. The second covers introducing ransomware onto a government-owned system and demanding payment to restore access.¹

Penalties Under Section 815.06

The charge level depends on what the defendant did and how much harm resulted.

The baseline offense is a third-degree felony, carrying up to 5 years in prison and a fine up to $5,000.¹³ It applies even when no data was stolen and no equipment was damaged. Unauthorized modification of computer equipment or supplies, without the more serious aggravators listed in the statute, is the one narrow exception treated as a first-degree misdemeanor (up to 1 year in jail, $1,000 fine).

The offense becomes a second-degree felony when any of these are present:

The offense caused at least $5,000 in damage or loss.
The offense furthered a scheme to defraud or obtain property.
The offense interrupted a government operation or a public service such as communication, transportation, or water supply.
The offense targeted a public or private transit system’s computer network.

A second-degree felony carries up to 15 years in prison and a fine up to $10,000.³⁴

The most serious tier is a first-degree felony, reserved for violations that endanger human life or disrupt medical equipment used in direct patient care.¹ Hacking into a hospital and crashing systems tied to life-support equipment fits this provision.

Prior felony convictions can push these ceilings higher. Under Florida’s habitual felony offender statute, a defendant with two or more qualifying priors who commits another felony within five years can face up to life for a first-degree felony, up to 30 years for a second-degree felony, and up to 10 years for a third-degree felony.⁵

Penalties for the Other Offense Categories

Offenses against intellectual property under Section 815.04 follow a two-tier structure. The default is a third-degree felony (up to 5 years, up to $5,000 fine). If the offense was committed as part of a fraud scheme, it becomes a second-degree felony (up to 15 years, up to $10,000 fine).²

Attacks on public utility systems under Section 815.061 and ransomware against government networks under Section 815.062 are prosecuted as standalone offenses in addition to any Section 815.06 charge that fits the same conduct.¹

Defenses and Statutory Exemptions

Section 815.06 contains three built-in exemptions. It does not apply to a person acting under a valid search warrant or a recognized warrant exception, acting within the scope of lawful employment, or performing authorized security operations for a government or business.¹ The third exemption is what protects penetration testers, red teams, and vulnerability researchers who have written permission. Freelance researchers probing systems without owner consent do not qualify.

Beyond the statutory exemptions, several defenses come up regularly.

Lack of intent. Every offense requires that the defendant acted “willfully, knowingly, and without authorization.” All three elements must be proven. A defendant who stumbled into a restricted system through a misconfigured login, a session that didn’t properly expire, or ambiguous employer policies has a real argument that the “knowingly” or “without authorization” element is missing. This defense is common in insider cases where the employee had some level of access and the dispute is over whether specific actions exceeded it.

Authorization disputes. Verbal permission from a supervisor, implied consent based on industry practice, or unclear acceptable-use policies can all leave the prosecution unable to prove that authorization was actually lacking.

Challenges to the evidence. Digital evidence is only as reliable as the process used to collect it. If law enforcement seized a computer, phone, or server without a valid warrant and no exception applied, the evidence can be suppressed under the Fourth Amendment. Florida courts have excluded digital evidence gathered through improper searches or where a broken chain of custody raised doubt about whether data was altered after collection.

Federal Exposure and Jurisdictional Reach

A Florida charge is not necessarily the only one. The same conduct can trigger federal prosecution under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. Federal penalties start at up to one year for basic unauthorized access and scale to 10 years for a first offense involving government computers or protected financial data, 20 years for repeat offenders, and up to life if the hacking results in death.⁶

Being charged in state court does not bar federal prosecution for the same conduct. Under the dual sovereignty doctrine, reaffirmed by the U.S. Supreme Court in Gamble v. United States (2019), state and federal governments are separate sovereigns and each can bring its own case.⁷

Florida’s own reach is broad. The statute treats a person who causes access to a Florida computer from another state as having personally accessed the system in Florida.¹ A defendant physically located elsewhere, including outside the country, can still face Florida charges if the targeted system was here.

Civil Liability and Breach Notification

Chapter 815 also opens a civil path for victims. The owner or lessee of a computer, system, network, or electronic device affected by a Section 815.06 violation can sue a person convicted under the statute for compensatory damages, and the court can award reasonable attorney fees to the prevailing party.¹ The civil remedy under this section requires a criminal conviction first; without one, a victim must rely on other causes of action.

Separately, if a computer crime exposes personal information, the affected business has its own obligations. Section 501.171 requires notice to each affected Florida resident within 30 days of discovering the breach, unless law enforcement requests a delay or the entity documents in writing that the breach is unlikely to result in identity theft or financial harm. Missing that deadline triggers civil penalties of $1,000 per day for the first 30 days, then $50,000 for each additional 30-day period, up to $500,000 per breach.⁸

1
The Florida Legislature. Florida Code Chapter 815 – Computer-Related Crimes
2
Florida Senate. Florida Code 815.04 – Offenses Against Intellectual Property
3
Justia Law. Florida Code 775.082 – Penalties and Applicability
4
Justia Law. Florida Code 775.083 – Fines
5
Florida Senate. Florida Code 775.084 – Violent Career Criminals, Habitual Felony Offenders, and Habitual Violent Felony Offenders
6
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
7
Constitution Annotated | Congress.gov. Dual Sovereignty Doctrine
8
Florida Senate. Florida Code 501.171 – Security of Confidential Personal Information